CVE-2026-22918
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-15

Last updated on: 2026-01-15

Assigner: SICK AG

Description
An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-15
Last Modified
2026-01-15
Generated
2026-06-16
AI Q&A
2026-01-15
EPSS Evaluated
2026-06-15
NVD
CVE-2026-22918
EUVD
EUVD-2026-2818
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
sick_ag tdc-x401gl to 1.4.0 (exc)
sick_ag meac300 *
sick_ag lector8xx *
sick_ag inspectorp8xx *
sick_ag dl100-2xxxxxxx *
sick_ag flexi_compact *
sick_ag picoscan *
sick_ag multiscan *
sick_ag field_analytics *
sick_ag media_server *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a missing protection against clickjacking attacks. An attacker can exploit this by tricking users into performing unintended actions on maliciously crafted web pages. This can lead to the extraction of sensitive data from the affected system.

Impact Analysis

The vulnerability can impact you by allowing attackers to trick users into unintended actions, potentially leading to the extraction of sensitive data. Although it does not directly affect confidentiality according to the CVSS score, it can cause integrity loss by unauthorized actions performed through clickjacking.

Mitigation Strategies

Immediate mitigation steps include implementing network segmentation and access controls as outlined in SICK's cybersecurity guidelines, such as using firewalls, VLANs, VPNs, and strict filtering of inbound and outbound traffic to reduce attack vectors. Additionally, monitoring device configurations and network activity continuously can help detect unauthorized changes. Since this vulnerability involves missing protection against clickjacking, applying web application security measures like Web Application Firewalls (WAF) is recommended. Contacting SICK PSIRT for official advisories and updates is also advised. [4, 1]

Compliance Impact

The vulnerability allows attackers to exploit missing clickjacking protections to trick users into unintended actions, potentially leading to extraction of sensitive data. This exposure of sensitive data could negatively impact compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information. Organizations using affected products should consider this risk in their security and compliance assessments and apply recommended mitigations to reduce the likelihood of data breaches. [4]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart