CVE-2026-22907
Published: 15 January 2026
Summary
CVE-2026-22907 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Sick Tdc-X401Gl Firmware. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-22907, published on 2026-01-15, is a critical vulnerability (CVSS 3.1 score of 9.9) mapped to CWE-266 (Incorrect Privilege Assignment for Critical Resource) and NVD-CWE-Other. It enables an attacker to gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data. The vulnerability affects components associated with SICK, as referenced in the vendor's PSIRT notices and CSAF advisories.
Exploitation requires low privileges (PR:L) and can occur over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The high scope impact (S:C) allows an attacker to achieve high confidentiality, integrity, and availability effects (C:H/I:H/A:H), such as broad read and modification access to system data on the affected host.
SICK's advisories, including the PSIRT page at https://sick.com/psirt and detailed CSAF documents at https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json and https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf, provide mitigation guidance and patches. Additional context on ICS recommended practices is available from CISA at https://www.cisa.gov/resources-tools/resources/ics-recommended-practices, with CVSS details at https://www.first.org/cvss/calculator/3.1.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2821
Vulnerability details
An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network exploitation (AV:N) of incorrect privilege assignment directly enables unauthorized host filesystem access for reading/modifying data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses CWE-266 incorrect privilege assignment by enforcing least privilege to prevent low-privilege attackers from gaining unauthorized host filesystem access.
Enforces access control policies to block unauthorized read and modification of host system data by unprivileged attackers.
Mandates timely flaw remediation through patching the specific vulnerability enabling network-based unauthorized host filesystem access.