CVE-2025-58582
📋 TL;DR
This vulnerability allows attackers to send excessively large payloads during failed login attempts, which are then logged without validation. This could lead to log file exhaustion or denial of service. Affected systems are those running vulnerable versions of SICK products with logging enabled.
💻 Affected Systems
- SICK products as listed in SCA-2025-0010
📦 What is this software?
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Log files fill available storage, causing system crashes, service disruption, or preventing legitimate log entries from being recorded.
Likely Case
Degraded system performance due to oversized log files, potential log rotation failures, and increased storage costs.
If Mitigated
Minimal impact with proper input validation and log size monitoring in place.
🎯 Exploit Status
Exploitation requires sending POST requests to login endpoints with oversized payloads. No authentication needed as it triggers on failed login attempts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions specified in SCA-2025-0010 advisory
Vendor Advisory: https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json
Restart Required: Yes
Instructions:
1. Review SCA-2025-0010 advisory for affected products. 2. Apply vendor-provided patches or updates. 3. Restart affected systems. 4. Verify logging functionality post-update.
🔧 Temporary Workarounds
Implement Input Validation
allAdd payload size validation on login endpoints before logging
Implementation specific to application framework
Configure Log Rotation
allSet up aggressive log rotation and size limits
Configure via application logging settings or system logrotate
🧯 If You Can't Patch
- Implement network-level rate limiting on login endpoints
- Monitor log file sizes and implement alerts for abnormal growth
🔍 How to Verify
Check if Vulnerable:
Send oversized POST payload to login endpoint and check if it's logged without truncationCheck Version:
Check product version via vendor-specific commands or web interfaceVerify Fix Applied:
Attempt to send oversized payload and verify it's either rejected or properly truncated in logs📡 Detection & Monitoring
Log Indicators:
- Unusually large log entries from failed login attempts
- Rapid log file growth
- Log entries containing extremely long strings
Network Indicators:
- Multiple large POST requests to login endpoints
- Failed authentication attempts with abnormal payload sizes
SIEM Query:
source="application_logs" AND event="failed_login" AND size_bytes>10000🔗 References
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
