CVE-2025-49191

Description

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.

Reserved 2025-06-03 | Published 2025-06-12 | Updated 2025-06-12 | Assigner SICK AG

Problem types

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

Product status

Default status
affected

all versions
affected

References

sick.com/psirt

cdn.sick.com/...ation_CYBERSECURITY_BY_SICK_en_IM0084411.PDF

www.cisa.gov/...es-tools/resources/ics-recommended-practices

www.first.org/cvss/calculator/3.1

www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf vendor-advisory

www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json vendor-advisory

cve.org (CVE-2025-49191)

nvd.nist.gov (CVE-2025-49191)

Download JSON