CVE-2026-22918
Published: 15 January 2026
Summary
CVE-2026-22918 is a medium-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Sick Tdc-X401Gl Firmware. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing SICK web interfaces directly enables remote exploitation via crafted pages for clickjacking-based data access.
NVD Description
An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.
Deeper analysisAI
CVE-2026-22918, published on 2026-01-15, is a vulnerability stemming from missing protection against clickjacking, classified under CWE-1021. It affects components from SICK, as detailed in the vendor's advisories. The issue carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, no privileges required, and user interaction needed, resulting in low integrity impact.
An unauthenticated remote attacker can exploit this vulnerability by creating maliciously crafted web pages that trick users into performing unintended actions on affected SICK web interfaces. Successful exploitation leads to the extraction of sensitive data through clickjacking techniques, where users are deceived into interacting with hidden or overlaid elements.
Mitigation details are outlined in SICK's PSIRT advisory at https://sick.com/psirt and the CSAF provider-specific advisories sca-2026-0001.json and sca-2026-0001.pdf available at https://www.sick.com/.well-known/csaf/white/2026/. Additional context includes CISA's ICS recommended practices at https://www.cisa.gov/resources-tools/resources/ics-recommended-practices and the FIRST CVSS v3.1 calculator at https://www.first.org/cvss/calculator/3.1.
Details
- CWE(s)