CVE-2026-22911

MEDIUM

Sick Tdc-x401gl Firmware - Insufficiently Protected Credentials

Title source: rule

Description

Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device.

References (6)

[Vendor Advisory] https://sick.com/psirt

[US Government Resource] https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

[Not Applicable] https://www.first.org/cvss/calculator/3.1

[Vendor Advisory] https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json

[Vendor Advisory] https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf

[Product] https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf

Scores

CVSS v3 5.3

EPSS 0.0003

EPSS Percentile 6.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-522 CWE-798

Status published

Affected Products (1)

sick/tdc-x401gl_firmware

Timeline

Published Jan 15, 2026

Tracked Since Feb 18, 2026