CVE Intelligence
Analysis AI-assisted

CVE-2026-22910: SICK TDC-X401GL Weak Default Passwords

CVE-2026-22910 describes SICK AG TDC-X401GL devices shipped with weak, publicly known default passwords for certain hidden user levels, which can enable unauthorized access. NVD rates it critical with a score of 9.1, while the vendor PSIRT and the CNA list 7.5. The sources consulted show no confirmed active exploitation, and no fixed version is listed in the record.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The SICK AG TDC-X401GL is covered by a CVE record describing weak and publicly known default passwords for certain hidden user levels. The record associates the issue with CWE-1391 and was published on 2026-01-15.

Impact

  • The record states that the weak default passwords increase the risk of unauthorized access.
  • The record describes this as a high risk to the integrity of the system.
  • NVD scores the issue 9.1 (critical). The vendor PSIRT and the CNA list 7.5 in the record.

Affected products and versions

  • SICK AG TDC-X401GL: the record lists the version as 'all versions'.
  • SICK AG Tdc-x401gl Firmware: the record states that versions are not specified by the source.
  • The record provides no allowed version strings, so this analysis does not state specific version ranges.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. The SSVC data in the record shows exploitation as none and automatable as yes. The EPSS probability is 0.00474 with a percentile of 0.40056.

Remediation and mitigation

  • The record contains no fixed version. The absence of a listed fix does not mean that no fix exists, so check the vendor advisory.
  • Review the vendor advisory and the SICK operating guidelines for guidance on changing default credentials and managing hidden account levels.
  • Restrict network exposure of the device and limit administrative interfaces to trusted management networks.
  • Inventory deployed units to identify devices that may still use default credentials.

Detection guidance

  • Monitor for logins to the device that use accounts or levels the operations team does not expect.
  • Review authentication events on management interfaces where logging is supported.

Limitations of the available information

  • The record does not include the full vendor advisory text, specific affected version ranges, fixed versions, or the names of the hidden user levels.
  • The record does not provide a CWE name.
  • The CVSS scores differ between NVD and the vendor sources in the record.

Frequently asked questions

What is the core problem in CVE-2026-22910?

The record says the SICK AG TDC-X401GL is deployed with weak, publicly known default passwords for certain hidden user levels, which increases the risk of unauthorized access.

Is this CVE known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.