Requests in the product embed authentication tokens in the URL query parameter, which can be captured by logs, proxy servers, or Referer headers. This leakage enables attackers to steal the token, potentially hijack the user’s session, and gain unauthorized access to the system. The vulnerability arises from improper handling of authentication credentials in the URL and can lead to confidentiality loss and unauthorized operations.

SICK AG Incoming Goods Suite is affected. No specific version information is disclosed.

The CVSS score of 5.3 indicates moderate risk. The EPSS score is below 1%, suggesting low current exploitation probability. The vulnerability is not listed in KEV, indicating no known exploit in the wild. Attackers would need to observe or capture traffic that includes the URL containing the token, which is feasible on unencrypted channels or when logs are improperly secured. The impact is limited to session hijack, but once hijacked, attackers could gain unrestricted access to the device functions.