Cyber Resilience

CVE-2026-22918

Sick Tdc-X401Gl Firmware

Published
15 January 2026
Modified
23 January 2026
Patch / advisory
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0029 21th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2026-22918 is a medium-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Sick Tdc-X401Gl Firmware. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-22918, published on 2026-01-15, is a vulnerability stemming from missing protection against clickjacking, classified under CWE-1021. It affects components from SICK, as detailed in the vendor's advisories. The issue carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, no privileges required, and user interaction needed, resulting in low integrity impact.

An unauthenticated remote attacker can exploit this vulnerability by creating maliciously crafted web pages that trick users into performing unintended actions on affected SICK web interfaces. Successful exploitation leads to the extraction of sensitive data through clickjacking techniques, where users are deceived into interacting with hidden or overlaid elements.

Mitigation details are outlined in SICK's PSIRT advisory at https://sick.com/psirt and the CSAF provider-specific advisories sca-2026-0001.json and sca-2026-0001.pdf available at https://www.sick.com/.well-known/csaf/white/2026/. Additional context includes CISA's ICS recommended practices at https://www.cisa.gov/resources-tools/resources/ics-recommended-practices and the FIRST CVSS v3.1 calculator at https://www.first.org/cvss/calculator/3.1.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1056 Input Capture Collection
Adversaries may use methods of capturing user input to obtain credentials or collect information.
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-22913Same product: Sick Tdc-X401Gl
CVE-2026-22919Same product: Sick Tdc-X401Gl
CVE-2026-22916Same product: Sick Tdc-X401Gl
CVE-2026-22910Same product: Sick Tdc-X401Gl
CVE-2025-49192Same vendor: Sick
CVE-2023-5103Same vendor: Sick
CVE-2026-22907Same product: Sick Tdc-X401Gl
CVE-2026-22909Same product: Sick Tdc-X401Gl
CVE-2026-22908Same product: Sick Tdc-X401Gl
CVE-2026-22911Same product: Sick Tdc-X401Gl

Affected Assets

sick
tdc-x401gl firmware
all versions

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require implementing frame-ancestors / X-Frame-Options controls that prevent this weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect missing frame protections, but does not itself implement the control.

degrades

Web filtering can block or sandbox untrusted frames, but does not enforce application-level frame-busting or CSP.

prevents

Application security requirements can mandate frame-ancestors / X-Frame-Options, directly addressing UI redressing risks.

prevents

Secure architecture principles include isolation of UI layers and proper use of browser security controls.

prevents

Secure coding practices directly require implementation of frame-busting headers or CSP frame-ancestors directives.

References