The R4E vulnerability arises because the TDC‑X401GL device lacks adequate clickjacking protection. By serving web pages that can be embedded in an attacker‑controlled frame, a malicious site could trick a legitimate user into executing unintended actions. This can result in the unauthorized disclosure of sensitive configuration or operational data without the user’s knowledge.

The flaw affects SICK AG’s TDC‑X401GL line, including both hardware and its accompanying firmware as identified in the CNA vendor listing. No specific firmware versions are listed, so all currently deployed devices may be vulnerable.

The CVSS base score is 4.3, indicating low severity, while the EPSS score is below 1%, suggesting rare exploitation. The vulnerability is not present in CISA’s KEV catalog. Proof‑of‑concept attacks only require a malicious web page and a user’s interaction, making the attack vector remote but dependent on user activity. No publicly available exploits are known, yet the potential for confidential data leakage remains.