Security readout for executives and security teams
Plain-English summary
CVE-2026-22917 affects SICK AG TDC-X401GL. A system endpoint handles input improperly, letting a low-privileged network attacker consume device resources and cause a denial of service. The published impact is availability only and rated medium, but in industrial environments even limited device disruption can affect operations.
Executive priority
Treat as a moderate operational resilience issue. It is not reported as actively exploited and has limited availability impact, but affected industrial devices may support business-critical processes. Prioritize inventory, exposure reduction, and vendor guidance review rather than emergency response unless the device is mission-critical or externally reachable.
Technical view
The issue is mapped to CWE-770 and has CVSS 3.1 score 4.3: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. Sources identify SICK AG TDC-X401GL version 0 as affected. The vulnerability can overload resources through a system endpoint, causing limited availability impact without confidentiality or integrity impact.
Likely exposure
Exposure is most likely where affected TDC-X401GL devices are reachable over a network by authenticated low-privileged users or compromised accounts. Internet exposure is not stated in the sources. Asset owners should prioritize environments where device availability supports production, safety, or monitoring workflows.
Exploitation context
CISA KEV is false, and the provided sources do not state active exploitation. The CVSS vector indicates network access, low attack complexity, low privileges required, and no user interaction. The supported outcome is denial of service, not data theft or code execution.
Researcher notes
The public bundle gives the weakness class, CVSS vector, affected product, and high-level denial-of-service impact, but does not include exploit details or a named patch. Avoid assuming broader SICK product impact. Focus validation on reachability, privilege boundaries, resource monitoring, and vendor CSAF/PDF updates.
Mitigation direction
- Check SICK PSIRT and advisory SCA-2026-0001 for vendor remediation or updates.
- Apply vendor-provided fixes or mitigations when confirmed applicable.
- Restrict network access to affected device management or system endpoints.
- Limit low-privileged accounts that can reach the affected endpoint.
- Segment ICS networks following CISA recommended practices.
- Monitor device resource usage and availability anomalies.
Validation and detection
- Inventory SICK TDC-X401GL devices and record firmware or product version details.
- Compare assets against SICK advisory SCA-2026-0001 affected-product statements.
- Confirm only trusted networks and users can reach system endpoints.
- Review logs and monitoring for repeated resource exhaustion or availability events.
- Document compensating controls if vendor remediation is not yet available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22917 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://sick.com/psirtCVE reference · x_SICK PSIRT Security Advisories
- https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdfCVE reference · x_SICK Operating Guidelines
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesCVE reference · x_ICS-CERT recommended practices on Industrial Security
- https://www.first.org/cvss/calculator/3.1CVE reference · x_CVSS v3.1 Calculator
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.jsonCVE reference · x_The canonical URL.
- https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdfCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.