CVE-2026-22907 is a critical flaw (CVSS 9.9) in the SICK TDC-X401GL telematic data collector. An attacker may gain unauthorized access to the host filesystem and read or modify system data. SICK recommends upgrading to the latest release, which its advisory gives as version 1.4.0 or later.
What's affected
The record lists the SICK TDC-X401GL telematic data collector, both the device and its firmware. SICK's CSAF advisory SCA-2026-0001 covers several CVEs for this product, and says SICK was not aware of public exploits when it published.
The vendor fix text for this CVE says users should upgrade to the latest release of TDC-X401GL, version 1.4.0 or later.
How to check if you're exposed
Log in to the device and read the firmware version. Then read the AppEngine setting, since several of these CVEs depend on it.
Check network placement too. SICK recommends minimizing network exposure of the devices and restricting access, so confirm the TDC-X401GL is not reachable from the internet or from broad office networks.
What to do now
- Upgrade the TDC-X401GL to firmware 1.4.0 or later.
- Restrict network access to the device and keep it off the public internet.
- Follow the SICK operating guidelines for cybersecurity.
- Review the other SICK CVEs for this product, since the same advisory lists several.
Why it matters
The record classifies this as CWE-266 (Incorrect Privilege Assignment). The system hands out more access than it should, and the scope change in the CVSS vector (S:C) means a compromise in one component reaches beyond it, here to the host.
A privilege flaw like this is common on devices that run containers or apps on top of a base system. The boundary between the app layer and the host has to hold. The record does not mark this CVE as a Known Exploited Vulnerability, and the SICK advisory says it knew of no public exploits when it published. That statement is a snapshot, not a guarantee.
Quick check
What version fixes it?
SICK says to upgrade to TDC-X401GL 1.4.0 or later.
Is a login needed?
The CVSS vector lists low privileges required, so some level of access is assumed.
Sources
Last reviewed: 19 October 2026.
