SICK TDC-X401GL Vulnerability Advisory: Multiple CVEs incl. RCE and Hardcoded Credentials

Vulnerability Key Information 1. Vulnerability Overview Multiple vulnerabilities exist in the SICK TDC-X401GL product, potentially impacting the confidentiality, integrity, and availability of the device. 2. Vulnerability Types and Impacts CVE-2026-22907: Incorrect permission assignment, potentially allowing unauthorized access to the host file system. CVE-2026-22988: Code injection vulnerability, leading to arbitrary system command execution. CVE-2026-22908: Improper control over service start/stop, enabling remote code execution. CVE-2026-22909: Inadequate access control, allowing system operations to be interrupted. CVE-2024-10771: Use of weak passwords, increasing risk of unauthorized access. CVE-2026-22910: Hardcoded credentials, enabling unauthorized remote access to the device. CVE-2026-22911: System file exposure due to insufficient input validation. CVE-2026-22912: Improper input validation causing transport layer redirection, leading to redirection to untrusted sites. CVE-2026-22913: Cross-site scripting (XSS) vulnerability, allowing execution of code within users' browsers. 3. Severity Ratings CVSS3.1: - CVE-2026-22907: 9.3 (Critical) - CVE-2024-10771: 8.8 (Critical) - CVE-2026-22908 & CVE-2026-22910: 9.1 (Critical) - Other vulnerabilities rated between 3.8 and 4.3 (Low to Medium) 4. Remediation and Mitigation Upgrade to the latest TDC-X401GL firmware. Disable the AppEngine service to reduce risk. Restrict device access to trusted entities only. 5. Summary SICK recommends users upgrade to the latest firmware, disable unnecessary services, and follow security guidelines to enhance device protection. Details on affected firmware versions (current and previous) are available in the provided documentation.

Goal Reached Thanks to every supporter — we hit 100%!

SICK TDC-X401GL Vulnerability Advisory: Multiple CVEs incl. RCE and Hardcoded Credentials