CVE-2026-22909: SICK AG TDC-X401GL Incorrect Authorization Vulnerability
SICK AG has published CVE-2026-22909 affecting the TDC-X401GL and its firmware, where certain system functions may be accessed without proper authorization. According to the record, an attacker could start, stop, or delete installed applications, potentially disrupting system operations. No confirmed exploitation appears in the sources consulted, and the available data does not specify affected versions.
Overview
CVE-2026-22909 was published on 2026-01-15 by SICK AG as a CNA. The record classifies it under CWE-863 (Incorrect Authorization). The weakness allows certain system functions to be reached without proper authorization checks.
Impact
According to the record, an attacker able to reach these functions could start, stop, or delete installed applications, which could disrupt system operations. The NVD base score is 9.1 (CVSS 3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), with high integrity and availability impact. SICK PSIRT and SICK AG list a 7.5 score under CVSS 3.1. SSVC data in the record shows exploitation as none, automatable as yes, and technical impact as partial.
Affected products and versions
- SICK AG TDC-X401GL, listed as all versions.
- SICK AG TDC-X401GL Firmware, with versions not specified by the source.
The record contains no version strings that can be used as endpoints, so no version ranges are stated here.
Exploitation status
The KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. EPSS gives a probability of 0.00554 and a percentile of 0.45539.
Remediation and mitigation
The record contains no fixed versions. The absence of fixed versions in the record does not mean no fix exists. Review the SICK PSIRT advisory SCA-2026-0001 and the SICK operating guidelines for cybersecurity, and apply the vendor's guidance. Restrict network access to the device to trusted management segments, and follow the ICS recommended practices from CISA.
Detection guidance
- Review logs for unexpected start, stop, or removal of applications on the device.
- Monitor access to device management functions from unexpected sources.
- Compare the installed application list against known baseline configurations.
Limitations of the available information
The record does not identify fixed versions, the exact list of affected firmware versions, or the specific functions involved. CVSS scores differ between providers. The vendor advisory referenced in the record was not reviewed in full for this analysis.
Frequently asked questions
What does CVE-2026-22909 allow?
According to the record, certain system functions can be accessed without proper authorization, which may allow starting, stopping, or deleting installed applications.
Is this CVE known to be exploited?
The KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record lists the TDC-X401GL as all versions and the firmware with versions not specified by the source. No version endpoints are available.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.