PT-2025-40858 · Sick Ag+1 · Enterprise Analytics+1

Published 2025-10-06 · Updated 2025-10-06 · CVE-2025-58578

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-58578

Description A user possessing the necessary permissions can create an unlimited number of user accounts through an API endpoint using a POST request. The system lacks quotas, validation, or restrictions to limit account creation. The API endpoint is susceptible to abuse, potentially leading to resource exhaustion or other malicious activities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-58578

Affected Products

Enterprise Analytics

Sick

References · 10

• https://sick.com/psirt · Vendor Advisory
• https://sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf · Vendor Advisory
• https://sick.com/.well-known/csaf/white/2025/sca-2025-0010.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58578 · Security Note
• https://first.org/cvss/calculator/3.1 · Note
• https://t.me/cveNotify/137461 · Telegram Post
• https://twitter.com/CVEnew/status/1975097890545524954 · Twitter Post
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://twitter.com/VulmonFeeds/status/1975137882202394827 · Twitter Post