CVE-2026-22908

CRITICAL

Sick Tdc-x401gl Firmware < 1.4.0 - Incorrect Privilege Assignment

Title source: rule

Description

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.

References (6)

[Vendor Advisory] https://sick.com/psirt

[Product] https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf

[US Government Resource] https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

[Not Applicable] https://www.first.org/cvss/calculator/3.1

[Vendor Advisory] https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json

[Vendor Advisory] https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf

Scores

CVSS v3 9.1

EPSS 0.0003

EPSS Percentile 8.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-266

Status published

Products (1)

sick/tdc-x401gl_firmware < 1.4.0

Published Jan 15, 2026

Tracked Since Feb 18, 2026