Security readout for executives and security teams
Plain-English summary
CVE-2026-22907 affects SICK AG TDC-X401GL. A low-privileged network attacker may access the host filesystem and read or modify system data. For an industrial device, this can create serious confidentiality, integrity, and availability risk. Public sources do not indicate active exploitation.
Executive priority
Treat as urgent for environments using SICK TDC-X401GL, especially production OT networks. Prioritize asset identification, vendor guidance review, and network restriction. Because no active exploitation is cited, urgency is driven by critical impact and likely operational consequences, not confirmed attacks.
Technical view
The CVE is rated CVSS 9.9 critical: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The weakness is CWE-266, incorrect privilege assignment. The source description states unauthorized host filesystem access with potential read and modify impact. The listed affected product is SICK AG TDC-X401GL, version 0/default affected.
Likely exposure
Exposure is most likely where SICK TDC-X401GL devices are reachable over networks by authenticated low-privileged users. Internet exposure, flat OT networks, shared credentials, or weak segmentation would increase business risk. The provided sources do not define exact deployment conditions or fixed versions.
Exploitation context
The CVSS vector indicates network access, low attack complexity, low privileges required, and no user interaction. CISA KEV is false in the provided bundle, and no cited source states active exploitation. Avoid assuming public exploit availability from the CVE record alone.
Researcher notes
Available public data is concise. It establishes product, severity, vector, CWE, and high-level impact, but not root-cause detail, affected build ranges beyond version 0/default affected, exploit status, or specific remediation. Research should stay aligned to SICK PSIRT materials and non-disruptive validation.
Mitigation direction
- Check SICK PSIRT advisory SCA-2026-0001 for vendor-approved updates or workarounds.
- Restrict network access to affected TDC-X401GL devices to trusted management segments.
- Apply CISA ICS recommended practices for segmentation, monitoring, and remote access control.
- Review and minimize user privileges on accounts able to reach these devices.
- Monitor device and network logs for unusual authenticated access or filesystem-related activity.
Validation and detection
- Inventory SICK TDC-X401GL devices and confirm software or firmware versions.
- Compare identified assets against SICK advisory SCA-2026-0001 affected-product information.
- Verify devices are not exposed to untrusted networks or the public internet.
- Review account roles for low-privileged users with network reachability to the device.
- Confirm compensating controls are documented if no vendor fix is yet applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22907 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://sick.com/psirtCVE reference · x_SICK PSIRT Security Advisories
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdfCVE reference · x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesCVE reference · x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1CVE reference · x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.jsonCVE reference · x_The canonical URL.
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdfCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.