An attacker who possesses low privileges may trigger critical system functions such as reboot or factory reset without adequate restrictions, leading to service disruption or loss of configuration. The flaw arises from inappropriate privilege checks, as indicated by CWE-266. As no arbitrary code execution is described, the impact is limited to availability and configuration integrity.

SICK AG TDC‑X401GL industrial controllers are affected. The vulnerability applies to the firmware that controls the AppEngine component; no specific firmware revision is cited, so all presently available TDC‑X401GL versions are considered potentially vulnerable.

The CVSS score of 4.3 reflects a moderate security impact, and the EPSS score of less than 1% indicates a low probability of observed exploitation at the time of analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires an attacker to have low privileges on the device, suggesting a local or network‑based attack path that can be exercised by someone who can access the device’s interface or control commands. This inference is drawn from the description, as the formal attack vector is not explicitly stated.