CVE-2026-22907: SICK TDC-X401GL: Unauthorized Host Filesystem Access (CWE-266)
SICK AG has published an advisory covering the TDC-X401GL and its firmware, with the record listing versions before 1.4.0 as affected. According to the record, an attacker may gain unauthorized access to the host filesystem, potentially reading and modifying system data. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-22907 is recorded against the SICK AG TDC-X401GL and its firmware. The record describes unauthorized access to the host filesystem, which could allow an attacker to read and modify system data. The weakness is mapped to CWE-266.
Impact
- The NVD CVSS score is 9.1, while the CNA's own scores in the record are 9.9.
- The record's SSVC assessment rates technical impact as total.
- Confidentiality and integrity are described as affected; availability is not indicated as affected in the record.
Affected products and versions
- SICK AG TDC-X401GL: before 1.4.0
- SICK AG Tdc-x401gl Firmware: before 1.4.0
The record's list of allowed version references contains only 1.4.0. No fixed versions are listed in the fixes field, so the vendor advisory should be checked for remediation details.
Exploitation status
The CVE is not listed in CISA KEV in the record. The EPSS probability is 0.00441 with a percentile of 0.37332, and the SSVC exploitation field is none. No confirmed active exploitation appears in the sources consulted.
Remediation and mitigation
- Inventory TDC-X401GL devices and their firmware levels, and identify any running before 1.4.0.
- Follow the SICK security advisory in PDF form and the SICK PSIRT advisories page for vendor guidance and update instructions.
- Apply the cybersecurity recommendations in the SICK Operating Guidelines.
- Restrict network exposure and limit administrative access to the device until it is updated.
Detection guidance
- Review access and audit logs on the device and connected systems for unexpected access to host filesystem locations.
- Monitor for unexpected changes to configuration or system files.
- Compare device firmware versions against the inventory to catch unpatched units.
Limitations of the available information
- The record has no English title and no CWE name.
- The record lists no fixed versions, so whether 1.4.0 is the fixed release is not confirmed by the record alone.
- NVD and the CNA report different CVSS scores.
- The record does not include technical details of the access path, so exploitation conditions are unknown.
Frequently asked questions
What does CVE-2026-22907 allow?
According to the record, an attacker may gain unauthorized access to the host filesystem and potentially read and modify system data.
Which SICK products are affected?
The record lists the SICK AG TDC-X401GL and the Tdc-x401gl Firmware as affected in versions before 1.4.0.
Is this vulnerability being actively exploited?
The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
What should operators do now?
Inventory affected devices, follow the SICK advisory and PSIRT guidance, restrict network and administrative exposure, and review logs for unexpected filesystem access.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.