CVE-2026-22909 is a high severity flaw (CVSS 7.5) in the SICK TDC-X401GL telematic data collector. Some system functions can be reached without proper authorization, so attackers can start, stop or delete installed applications. SICK says the mitigation is to disable AppEngine once the initial device setup is complete.
What's affected
The record lists the SICK TDC-X401GL telematic data collector, both the device and its firmware. SICK's CSAF advisory SCA-2026-0001 covers several CVEs for this product, and says SICK was not aware of public exploits when it published.
For this CVE the SICK advisory gives a workaround rather than a firmware fix: after the initial setup, deactivate AppEngine. SICK states that disabling it fully mitigates this vulnerability.
How to check if you're exposed
Log in to the device and read the firmware version. Then confirm whether AppEngine is still active.
Check network placement too. SICK recommends minimizing network exposure of the devices and restricting access, so confirm the TDC-X401GL is not reachable from the internet or from broad office networks.
What to do now
- Finish the initial device setup, then deactivate AppEngine, as SICK describes.
- Check whether any apps on the device have stopped, disappeared or changed unexpectedly.
- Limit network access to the device.
- Watch the SICK PSIRT page for further updates to this advisory.
Why it matters
The record lists CWE-284 (Improper Access Control) and CWE-863 (Incorrect Authorization). Functions that manage applications do not check who is asking, so anyone who can reach them can change what runs on the device.
The impact described is disruption: apps can be stopped or removed. For an industrial data collector, that can mean lost data or lost visibility rather than data theft, which matters in operations. A score of 7.5 is high but not critical, and the vendor workaround is simple. The record does not mark this CVE as exploited in the wild.
Quick check
Is there a firmware fix?
The advisory lists a workaround for this CVE, which is to disable AppEngine after initial setup.
Does disabling AppEngine remove the whole risk?
SICK states it fully mitigates this vulnerability.
Sources
Last reviewed: 19 October 2026.
