CVE-2025-49189
📋 TL;DR
This vulnerability involves a session cookie named '@@' being configured without the HttpOnly flag, making it accessible to client-side scripts. This increases the risk of cross-site scripting (XSS) attacks that could steal session cookies. The vulnerability affects SICK industrial automation products and systems using these products.
💻 Affected Systems
- SICK industrial automation products
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies via XSS, leading to session hijacking, unauthorized access to industrial control systems, and potential manipulation of industrial processes.
Likely Case
Session cookie theft leading to unauthorized access to web interfaces of affected industrial devices, potentially allowing configuration changes or data exfiltration.
If Mitigated
Limited impact with proper network segmentation, web application firewalls, and XSS protections in place.
🎯 Exploit Status
Exploitation requires XSS vulnerability or similar client-side attack vector to access the cookie
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory SCA-2025-0007 for specific patched versions
Vendor Advisory: https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json
Restart Required: Yes
Instructions:
1. Review SICK advisory SCA-2025-0007. 2. Identify affected products and versions. 3. Apply vendor-provided firmware updates. 4. Restart affected devices. 5. Verify HttpOnly flag is set on session cookies.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF with XSS protection rules to block cookie theft attempts
Network Segmentation
allIsolate affected industrial devices from untrusted networks
🧯 If You Can't Patch
- Implement strict network access controls to limit web interface access to authorized personnel only
- Deploy additional XSS protection mechanisms and regularly audit web application security
🔍 How to Verify
Check if Vulnerable:
Inspect browser developer tools to check if session cookie '@@' has HttpOnly flag set to falseCheck Version:
Check device firmware version via web interface or vendor-specific toolsVerify Fix Applied:
Verify session cookie '@@' now has HttpOnly flag set to true in browser developer tools📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to web interfaces
- Multiple failed authentication attempts
Network Indicators:
- Suspicious HTTP requests attempting to access cookies
- XSS payloads in web traffic
SIEM Query:
web_access_logs AND (cookie_access OR xss_patterns)🔗 References
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf
