CVE-2025-58578: A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request

Medium severity · published Oct 6, 2025

CVE-2025-58578

A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request

4.3

CVSS

0.3%

EPSS

On KEV

Description

A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 25% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Enterprise Analytics · Sick

All versions, or not specified · source: NVD

Affected product

Enterprise Analytics

Sick

All Enterprise Analytics CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-58578

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-58578

Vendor Advisory

https://sick.com/psirt

US Government Resource

https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Not Applicable

https://www.first.org/cvss/calculator/3.1

Vendor Advisory

https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json

Vendor Advisory

https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf

Product

https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf