SICK Field Analytics and Media Server Missing Authorization Vulnerability Allowing Information Disclosure and Denial-of-Service

A vulnerability exists in SICK Field Analytics and SICK Media Server due to a missing authorization on an API endpoint. This flaw allows unauthorized users to send HTTP GET requests to access sensitive information. Additionally, attackers can use HTTP POST requests to alter the log files' root path and the TCP ports the service operates on, potentially causing a denial-of-service condition.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information and manipulation of log file paths and TCP ports, causing a denial-of-service condition.

Remediation

Users can enable authorization for the API endpoint by obtaining a license. For SICK Media Server versions through 1.4, upgrading to version 1.5 or later is recommended.