Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-0867 is a critical-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Sick (inferred from references). Its CVSS base score is 9.9 (Critical).
Operationally, ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-0867 is a critical privilege escalation vulnerability (CVSS 9.9, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) stemming from improperly stored administrator credentials in SICK's MEAC applications running on EPC2 systems. The issue, tied to CWE-522 (Insufficiently Protected Credentials), arises because the applications use a "run as" function to launch with administrative privileges, and the admin credentials are stored to enable automatic startup. This was publicly disclosed on 2025-02-14.
A low-privileged EPC2 user, which operates as a standard user, can exploit the stored credentials to execute arbitrary commands with full administrative privileges, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires low privileges (PR:L) but can be performed over the network (AV:N) without user interaction (UI:N), with a scope change (S:C) enabling high-impact escalation across the affected system.
SICK has issued advisories via its PSIRT page, a dedicated cybersecurity PDF document, and a CSAF provider document (sca-2025-0001.json), which outline the vulnerability details and recommended mitigations for affected MEAC applications on EPC2 systems. Additional context is available from CISA's ICS recommended practices and the FIRST CVSS calculator.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1903
Vulnerability Data
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any…
more
command with administrative privileges. This allows a privilege escalation to the administrative level.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Protection of information at rest requires encryption or equivalent safeguards for stored credentials.
Transmission confidentiality and integrity enforcement stops credentials from being sent in plaintext or without protection.
Authenticator management requires secure generation, storage, and distribution of credentials, directly stopping insecure methods.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).
A.8.24's purpose, guidance (b,c), and key management mandate proper cryptography (algorithms, strength, protection of credentials in storage/transmission) per classification, which stops exploitation of insufficiently-protected credentials; remainder is bounded (e.g. non-cryptographic protections like hashing-only or non-crypto obfuscation per CWE-522 details).
A.8.5 mandates MFA, alternative strong methods, no cleartext transmission/storage of passwords, session termination, brute-force protection and secure log-on procedures that directly stop interception/retrieval of credentials even when they exist, leaving only a bounded remainder (e.g. non-password credentials or post-authentication storage outside log-on flows)
Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.