CVE-2026-22908 is a critical flaw (CVSS 9.1) in the SICK TDC-X401GL telematic data collector. Uploading unvalidated container images may let remote attackers gain full access to the system. SICK says to upgrade to the latest release, given in its advisory as version 1.4.0 or later.
What's affected
The record lists the SICK TDC-X401GL telematic data collector, both the device and its firmware. SICK's CSAF advisory SCA-2026-0001 covers several CVEs for this product, and says SICK was not aware of public exploits when it published.
The vendor fix for this CVE is an upgrade to the latest TDC-X401GL release, 1.4.0 or later.
How to check if you're exposed
Log in to the device and read the firmware version. Then note whether AppEngine is enabled and who can upload applications.
Check network placement too. SICK recommends minimizing network exposure of the devices and restricting access, so confirm the TDC-X401GL is not reachable from the internet or from broad office networks.
What to do now
- Upgrade the TDC-X401GL to firmware 1.4.0 or later.
- Restrict who can upload applications or images to the device.
- Limit network exposure and use segmentation around operational technology.
- Audit installed applications for any you did not deploy.
Why it matters
The record lists CWE-266 (Incorrect Privilege Assignment). The device accepts container images without validating them, and a container that runs with more reach than it should can take the system with it.
The same idea applies in data centers. An image registry or upload path that accepts anything turns the runtime into a way to run an attacker's code. Controls like image signing, an allow list of sources and scanning before deployment reduce that risk. A scan of the image contents catches known vulnerable components, though it does not replace trust in who is allowed to upload. The record does not mark this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does scanning fix this?
No. The flaw is on the device, so the fix is the firmware update. Scanning images before they reach any runtime is still good practice.
What score does it carry?
9.1 in the record, which is critical.
Sources
Last reviewed: 19 October 2026.
