Cyber Posture

CVE-2026-22920

Low

Published: 15 January 2026

Published
15 January 2026
Modified
23 January 2026
KEV Added
—
Patch
—
CVSS Score 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0002 5.8th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22920 is a low-severity Use of Weak Credentials (CWE-1391) vulnerability in Sick Tdc-X401Gl Firmware. Its CVSS base score is 3.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Password Cracking (T1110.002) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

IA-5 Authenticator Management
addresses: CWE-1391

Ensuring sufficient strength of mechanism for authenticators prevents use of weak credentials.

IA-7 Cryptographic Module Authentication
addresses: CWE-1391

Enforces use of credentials that comply with standards rather than weak credentials for module access.

MITRE ATT&CK Enterprise TechniquesAI

T1110.002 Password Cracking Credential Access
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Lack of salting enables offline password cracking and indicates insecure credential storage/extraction on the device.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The device's passwords have not been adequately salted, making them vulnerable to password extraction attacks.

Deeper analysisAI

CVE-2026-22920 affects SICK devices, where passwords are not adequately salted, rendering them vulnerable to password extraction attacks. Published on 2026-01-15, the vulnerability carries a CVSS v3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and is associated with CWE-1391.

Attackers with network access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation enables low-impact confidentiality breaches, specifically the extraction of unsalted passwords from the device.

Mitigation details are available in SICK's PSIRT advisory at https://sick.com/psirt and the associated CSAF provider document sca-2026-0001 (JSON: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json; PDF: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf). Additional resources include CISA ICS recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices) and the FIRST CVSS v3.1 calculator (https://www.first.org/cvss/calculator/3.1).

Details

CWE(s)
CWE-1391

Affected Products

sick
tdc-x401gl firmware
all versions

CVEs Like This One

CVE-2026-22910Same product: Sick Tdc-X401Gl
CVE-2026-22917Same product: Sick Tdc-X401Gl
CVE-2026-22918Same product: Sick Tdc-X401Gl
CVE-2026-22907Same product: Sick Tdc-X401Gl
CVE-2026-22908Same product: Sick Tdc-X401Gl
CVE-2026-22911Same product: Sick Tdc-X401Gl
CVE-2026-22909Same product: Sick Tdc-X401Gl
CVE-2026-22644Same vendor: Sick
CVE-2026-22646Same vendor: Sick
CVE-2026-1626Same vendor: Sick

References