Cyber Resilience

CVE-2026-22920

N/AUpdated

Published: 15 January 2026

Published
15 January 2026
Modified
12 May 2026
KEV Added
—
Patch
—
CVSS Score N/A
EPSS Score 0.0002 5.8th percentile
Risk Priority 0 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22920 is a uncategorised-severity an unspecified weakness vulnerability. Its CVSS base score is N/A.

Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest).

Deeper analysis

CVE-2026-22920 affects SICK devices, where passwords are not adequately salted, rendering them vulnerable to password extraction attacks. Published on 2026-01-15, the vulnerability carries a CVSS v3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and is associated with CWE-1391.

Attackers with network access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation enables low-impact confidentiality breaches, specifically the extraction of unsalted passwords from the device.

Mitigation details are available in SICK's PSIRT advisory at https://sick.com/psirt and the associated CSAF provider document sca-2026-0001 (JSON: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json; PDF: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf). Additional resources include CISA ICS recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices) and the FIRST CVSS v3.1 calculator (https://www.first.org/cvss/calculator/3.1).

EU & UK References

Vulnerability details

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1110.002 Password Cracking Credential Access
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Lack of salting enables offline password cracking and indicates insecure credential storage/extraction on the device.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-22910Same product: Sick Tdc-X401Gl
CVE-2026-22908Same product: Sick Tdc-X401Gl
CVE-2026-22918Same product: Sick Tdc-X401Gl
CVE-2026-22911Same product: Sick Tdc-X401Gl
CVE-2026-22917Same product: Sick Tdc-X401Gl
CVE-2026-22909Same product: Sick Tdc-X401Gl
CVE-2026-22907Same product: Sick Tdc-X401Gl
CVE-2026-1627Same vendor: Sick
CVE-2026-22646Same vendor: Sick
CVE-2026-1626Same vendor: Sick

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management good match
prevent

Directly requires secure generation, storage, and management of authenticators (passwords), mandating salted hashes to prevent extraction attacks on SICK devices.

SC-28 Protection of Information at Rest good match
prevent

Requires cryptographic protection of information at rest, directly mitigating extraction of unsalted passwords stored on the device.

SC-13 Cryptographic Protection partial match
prevent

Mandates use of approved cryptographic mechanisms for protecting authenticators, addressing the missing salting/hashing implementation.

References