CVE-2025-49187
📋 TL;DR
This vulnerability allows attackers to enumerate valid usernames by observing different error messages for incorrect passwords versus non-existent usernames during failed login attempts. This affects any system using the vulnerable authentication mechanism, potentially exposing user accounts to targeted brute-force attacks.
💻 Affected Systems
- SICK industrial devices and software with vulnerable authentication
📦 What is this software?
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers can enumerate all valid usernames, then perform targeted password attacks leading to account compromise and potential lateral movement.
Likely Case
Attackers discover valid usernames and use them for targeted phishing, social engineering, or credential stuffing attacks.
If Mitigated
Username enumeration prevented, forcing attackers to guess both username and password combinations.
🎯 Exploit Status
Exploitation requires only network access to login endpoint and basic scripting to automate username guessing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Check vendor advisory for affected products. 2. Apply recommended patches or firmware updates. 3. Restart affected systems. 4. Verify fix by testing login error messages.
🔧 Temporary Workarounds
Standardize Error Messages
allConfigure authentication system to return identical generic error messages for all failed login attempts.
Implement Rate Limiting
allAdd rate limiting on login attempts to slow down username enumeration.
🧯 If You Can't Patch
- Implement network-level controls to restrict access to authentication endpoints
- Deploy web application firewall rules to detect and block username enumeration patterns
🔍 How to Verify
Check if Vulnerable:
Attempt login with non-existent username and incorrect password for known user; compare error messages for differences.Check Version:
Check device/system firmware/software version via vendor-specific methodsVerify Fix Applied:
Test login attempts with both invalid username and incorrect password; ensure identical generic error messages.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with varying usernames
- Pattern of 'username does not exist' errors
Network Indicators:
- Unusual volume of authentication requests from single source
- Sequential username guessing patterns
SIEM Query:
source="auth_logs" | stats count by src_ip, username | where count > threshold🔗 References
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf
