Security readout for executives and security teams
Plain-English summary
CVE-2026-22908 affects SICK AG TDC-X401GL. If an attacker with high privileges can upload an unvalidated container image, they may gain full system access and compromise confidentiality and integrity. The score is critical, but the published CVSS indicates high privileges are required before exploitation.
Executive priority
Treat as high priority for any operational environment using TDC-X401GL, especially where remote administration is enabled. Prioritize exposure reduction and vendor guidance review, while noting exploitation requires high privileges based on the published CVSS.
Technical view
The issue is described as unvalidated container image upload leading to full system access. CVSS 3.1 is 9.1: network-accessible, low complexity, high privileges required, no user interaction, scope changed, and high impact to confidentiality, integrity, and availability. The CVE maps to CWE-266 and lists TDC-X401GL version 0 as affected.
Likely exposure
Most exposed environments are those where SICK TDC-X401GL systems permit container image uploads by privileged remote users. Internet exposure, weak administrative separation, or shared privileged accounts would increase business risk. Evidence does not show broad unauthenticated exposure.
Exploitation context
The source bundle does not identify active exploitation, public exploit code, or CISA KEV listing. Exploitation appears to require an attacker already holding high privileges, but successful abuse could result in full system compromise.
Researcher notes
Public details are limited. The core unknowns are exact vulnerable versions beyond the listed “0,” vendor fix status, and validation criteria. Avoid assuming unauthenticated exploitation; CVSS explicitly states PR:H. Use SICK CSAF/PDF advisory as the canonical source.
Mitigation direction
- Review SICK advisory SCA-2026-0001 and PSIRT guidance for vendor-approved remediation.
- Restrict container image upload rights to essential trusted administrators only.
- Limit network access to management interfaces using industrial network segmentation.
- Apply SICK operating guidelines and CISA ICS recommended practices.
- Monitor vendor channels for patches, workarounds, or updated affected-version details.
Validation and detection
- Inventory SICK TDC-X401GL deployments and confirm software or product version details.
- Check whether container image upload functionality is enabled and who can use it.
- Review logs for recent container image uploads or administrative changes.
- Verify management interfaces are not reachable from untrusted networks.
- Compare local configuration against SICK advisory and operating guideline recommendations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22908 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H2.36Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://sick.com/psirtCVE reference · x_SICK PSIRT Security Advisories
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdfCVE reference · x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesCVE reference · x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1CVE reference · x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.jsonCVE reference · x_The canonical URL.
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdfCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.