This vulnerability is a cross‑site scripting flaw (CWE‑79). The SICK TDC‑X401GL improperly handles a URL parameter during the web interface’s operation, enabling attackers to inject and run arbitrary JavaScript in a victim’s browser after the victim has logged into the device. Once executed, the script can read session tokens, cookie values, and any other data stored in the browser context, allowing sensitive data to be exfiltrated. The CVE description does not state whether the attacker must be authenticated; based on the wording, it is inferred that the victim must be logged in, while the attacker need only supply a crafted link.

SICK AG’s TDC‑X401GL devices are affected. Any firmware prior to version 1.5.0 contains the flaw; the vendor recommends upgrading to firmware 1.5.0 or later to remediate the issue. No other version information is available.

The CVSS Base score of 4.3 indicates moderate severity, and the EPSS score of < 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The flaw requires the victim to be logged into the device’s web interface and be directed to a crafted URL, making social engineering or a compromised link the primary attack vector. In environments where users browse from the device console, the risk is heightened because the client‑side code runs with the user's privileges.