CVE-2026-22910highCWE-1391

CVE-2026-22910: high-severity vulnerability in SICK AG TDC-X401GL

Published

Follow this CVE+ Monitor TDC-X401GL

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
In short

The device comes with weak, easily guessable default passwords for hidden administrative accounts. An attacker who knows these commonly published passwords can gain unauthorized access and compromise the system.

Technical detail

The vulnerability exists due to hardcoded default credentials in hidden user privilege levels (CWE-1391: Weak Authentication). An attacker with network access can authenticate using publicly known default passwords, bypassing access controls and gaining elevated privileges to modify system configuration or data integrity.

Summary generated and translated by AI from the official description.
The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the integrity of the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
SICK AG · TDC-X401GL
Related CVEs — SICK AG TDC-X401GL

In the same product, most dangerous first.

CVE-2024-10771HIGHSICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code executionEPSS 1.1%CVE-2026-22908CRITICALCVE-2026-22908EPSS 0.6%CVE-2026-22909HIGHCVE-2026-22909EPSS 0.6%CVE-2026-22917MEDIUMCVE-2026-22917EPSS 0.6%CVE-2026-22911MEDIUMCVE-2026-22911EPSS 0.5%CVE-2026-22907CRITICALCVE-2026-22907EPSS 0.4%