SICK Field Analytics and Media Server User Enumeration Vulnerability

A vulnerability exists in SICK Field Analytics and SICK Media Server in all versions prior to 1.5, allowing for username enumeration through inconsistent error messages during login attempts. This discrepancy lets attackers identify valid usernames by distinguishing between failures caused by incorrect passwords and those due to non-existent usernames.

Impact

Exploitation of this vulnerability allows for user enumeration, where an attacker can identify valid usernames on the system.

Remediation

Users of SICK Media Server are advised to upgrade to version 1.5 or later. For SICK Field Analytics, it is recommended to apply general security practices when operating the product, such as minimizing network exposure and restricting access to trusted entities.