CVE-2025-58586: User Enumeration by excessive error output

Published Oct 6, 2025

Updated

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.

Affected Software

5 affected components

SICK Baggage Analytics

SICK Enterprise Analytics

SICK Logistic Diagnostic Analytics

SICK Package Analytics

SICK Tire Analytics

Remediation

Information

For Logistic Analytics Products: It is strongly recommended to update the product to version 4.6.3.

Event History

Oct 6, 2025

CVE Published

via MITRE·07:02 AM

Data Sourced

via MITRE·07:02 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-58586?

CVE-2025-58586 is classified as a medium severity vulnerability due to its potential for user enumeration.

How do I fix CVE-2025-58586?

To fix CVE-2025-58586, implement consistent error messages for failed login attempts regardless of the reason.

Who is affected by CVE-2025-58586?

CVE-2025-58586 affects several SICK products including Baggage Analytics and Enterprise Analytics.

What are the risks associated with CVE-2025-58586?

The risks of CVE-2025-58586 include unauthorized access and potential compromise of user accounts due to exploitable login weaknesses.

Is there a workaround for CVE-2025-58586?

Yes, as a temporary workaround, you can obscure error messages displayed during failed login attempts.