CVE-2025-9913: Sick Baggage Analytics XSS Vulnerability

CVE-2025-9913 Overview

CVE-2025-9913 is a reflected Cross-Site Scripting (XSS) vulnerability affecting multiple SICK analytics products. Attackers can execute arbitrary JavaScript in the browser address bar through the dashboard "Open in new Tab" button. The flaw enables session hijacking against authenticated users who interact with a crafted link. The vulnerability maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to hijack authenticated sessions of SICK analytics dashboard users, gaining access to industrial logistics and package analytics data.

Affected Products

SICK Baggage Analytics
SICK Logistic Diagnostic Analytics
SICK Package Analytics
SICK Tire Analytics

Discovery Timeline

2025-10-06 - CVE-2025-9913 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9913

Vulnerability Analysis

The vulnerability resides in the dashboard's "Open in new Tab" feature within the affected SICK analytics products. The application constructs the URL for the new tab without properly sanitizing or validating input. As a result, JavaScript payloads placed into the address bar execute in the context of the authenticated user's browser session.

Because the executed script runs under the same origin as the analytics dashboard, it can access session cookies, tokens, and other browser storage. Attackers use this access to hijack the session and impersonate the victim. Exploitation requires user interaction, since the target must click a crafted link or trigger the vulnerable button on an attacker-controlled input.

The scope is marked as changed because injected script can affect resources beyond the initially vulnerable component, including any browser-accessible data belonging to the user.

Root Cause

The root cause is improper neutralization of user-controllable input rendered into the URL context used by the "Open in new Tab" handler. The application trusts input that reaches the address bar without applying output encoding or URL scheme validation, permitting javascript: URI execution.

Attack Vector

An attacker crafts a payload that, when loaded by the dashboard's "Open in new Tab" workflow, produces a javascript: URI in the address bar. The victim, an authenticated dashboard user, triggers the button and the browser executes the payload. The script then exfiltrates session identifiers to attacker-controlled infrastructure. Attackers deliver the malicious link through phishing, chat, or embedded content targeting operators of SICK analytics dashboards.

No verified public proof-of-concept exploit is available. See the SICK CSAF advisory (PDF) for vendor-provided technical details.

Detection Methods for CVE-2025-9913

Indicators of Compromise

Browser or proxy logs containing javascript: URI schemes generated from the SICK analytics dashboard "Open in new Tab" workflow.
Outbound HTTP requests from dashboard user browsers to unknown external hosts carrying session cookie values or authentication tokens.
Unexpected session activity from IP addresses or user agents that do not match the legitimate operator's baseline.

Detection Strategies

Inspect web proxy and application logs for URL parameters containing script-like patterns (<script, onerror=, javascript:) referencing analytics dashboard endpoints.
Deploy Content Security Policy (CSP) monitoring to flag inline script violations originating from the SICK analytics user interface.
Correlate authentication events with browser telemetry to identify session reuse from unexpected endpoints.

Monitoring Recommendations

Enable audit logging on the SICK analytics application and forward events to a centralized SIEM for retention and correlation.
Monitor endpoint browser telemetry for navigation to javascript: URIs originating from the analytics dashboard domain.
Track privileged dashboard account activity for concurrent sessions or geographic anomalies.

How to Mitigate CVE-2025-9913

Immediate Actions Required

Review the SICK PSIRT advisory SCA-2025-0010 and apply the vendor-provided fixes for all affected analytics products.
Restrict network access to the analytics dashboards to trusted operator workstations following CISA ICS Recommended Practices.
Instruct dashboard operators to avoid clicking untrusted links or opening dashboards from unverified sources until patches are deployed.

Patch Information

SICK has published advisory SCA-2025-0010 covering CVE-2025-9913. Refer to the SICK PSIRT portal and the machine-readable CSAF JSON advisory for fixed versions and update procedures for Baggage Analytics, Logistic Diagnostic Analytics, Package Analytics, and Tire Analytics.

Workarounds

Segment the analytics dashboards from general IT networks and expose them only through hardened jump hosts.
Enforce a strict Content Security Policy on reverse proxies fronting the analytics dashboards to block inline script execution.
Require short-lived session tokens and enforce re-authentication for sensitive dashboard actions to limit the value of hijacked sessions.
Follow the hardening guidance in the SICK Cybersecurity Operating Guidelines.

bash

# Example nginx reverse proxy CSP header for SICK analytics dashboards
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;