An attacker with administrative access to the Sick TDC‑X401GL system is able to inject malicious code into the device’s login page. This flaw is a classic cross‑site scripting vulnerability that could allow the attacker to execute arbitrary scripts in the context of users who view the page, potentially leading to the theft of sensitive information. The core weakness is improper input validation in the login page rendering process, identified as CWE‑79.

SICK AG’s TDC‑X401GL line, including all firmware and software builds that have not been updated to the latest release (1.5.0 or later). No specific firmware version range is provided, but the recommendation indicates that versions older than 1.5.0 are impacted.

The CVSS score of 3.8 classifies the problem as low to moderate severity. The estimated EPSS score of less than 1 % suggests that real‑world exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires privileged administrative access to the device, so the attack surface is limited to environments where such credentials exist. Once accessed, an attacker could place malicious script fragments into the login page, which would run in the browsers of any users who view the page, enabling the extraction of credentials or other confidential data.