CVE-2026-22910 is a high severity flaw (CVSS 7.5) in the SICK TDC-X401GL telematic data collector. The device ships with weak and publicly known default passwords for certain hidden user levels, which raises the risk of unauthorized access. SICK says to deactivate AppEngine after the initial setup to mitigate it.
What's affected
The record lists the SICK TDC-X401GL telematic data collector, both the device and its firmware. SICK's CSAF advisory SCA-2026-0001 covers several CVEs for this product, and says SICK was not aware of public exploits when it published.
The SICK advisory gives a workaround for this CVE: once the initial setup is complete, deactivate AppEngine. SICK states that this fully mitigates the vulnerability.
How to check if you're exposed
Log in to the device and read the firmware version. Then confirm that AppEngine is off.
Check network placement too. SICK recommends minimizing network exposure of the devices and restricting access, so confirm the TDC-X401GL is not reachable from the internet or from broad office networks.
What to do now
- Complete the initial setup, then deactivate AppEngine.
- Keep the device off the public internet and behind a firewall.
- Review accounts and recent logins for anything unexpected.
- Apply the 1.4.0 or later firmware if you are also exposed to the other SICK CVEs for this product.
Why it matters
The record lists CWE-1391 (Use of Weak Credentials), use of weak credentials. Default passwords that the public can look up are not a secret, so they protect nothing once a device is reachable.
Hidden accounts make it worse, since an administrator may not know to change them. The general lesson for device buyers is to ask vendors for a list of all built in accounts and to require that credentials be unique per device. The record does not mark this CVE as exploited in the wild.
Quick check
Can I just change the passwords?
The advisory does not say that. It names disabling AppEngine as the mitigation, so follow that.
How is this different from CVE-2026-22909?
Both share the same workaround, but this one is about default credentials and that one is about missing authorization on app functions.
Sources
Last reviewed: 19 October 2026.
