A flaw in the SICK TDC‑X401GL allows an attacker with low privileges to read files located in certain device directories, exposing potentially sensitive data. This weakness is a classic lack of restriction on visible files, known as CWE‑497, and threatens the confidentiality of information stored on the device.

The vulnerability affects SICK AG’s TDC‑X401GL industrial device, covering all firmware builds listed under the product’s CPE entries. No specific firmware version is singled out, so all variants of this device model should be considered potentially exposed.

With a CVSS score of 4.3 the risk is moderate, and the EPSS score of less than 1% implies a low probability of exploitation at present. The vulnerability requires low‑privilege access, so an attacker needs to authenticate with a user account that has limited rights, likely after the initial device setup. It is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Mitigation through device configuration changes can effectively block the attack path.