« Volver al listado

CVE-2026-22912

Estado: AnalizadaMedia (6.1)—

Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sick — Tdc-x401gl Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22912",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22912",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-15T16:36:11.182369Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@sick.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@sick.de",
      "affectedData": [
        {
          "vendor": "SICK AG",
          "product": "TDC-X401GL",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.5.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-15T13:16:05.960",
  "references": [
    {
      "url": "https://sick.com/psirt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
      "tags": [
        "US Government Resource"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.first.org/cvss/calculator/3.1",
      "tags": [
        "Not Applicable"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@sick.de"
    },
    {
      "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf",
      "tags": [
        "Product"
      ],
      "source": "psirt@sick.de"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@sick.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users."
    },
    {
      "lang": "es",
      "value": "Validación incorrecta de un parámetro de inicio de sesión puede permitir a los atacantes redirigir a los usuarios a sitios web maliciosos después de la autenticación. Esto puede llevar a varios riesgos, incluyendo el robo de credenciales de usuarios desprevenidos."
    }
  ],
  "lastModified": "2026-06-17T10:20:36.280",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sick:tdc-x401gl_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74DEFD78-EEE6-41B4-8E38-E6C5081206D0",
              "versionEndExcluding": "1.5.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sick:tdc-x401gl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9A95E220-0816-4885-AB7C-D0BB6F27DB7A"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@sick.de"
}