The device stores passwords without adequate salting, creating a weakness that allows an attacker to extract and recover those passwords. This vulnerability can lead to compromise of device credentials, providing unauthorized access to device configuration, monitoring data, and potentially related network resources. The weakness is classified as CWE-1391, which identifies the use of cryptographic keys or password hashing functions with insufficient salting.

The vulnerability affects all SICK AG TDC‑X401GL devices. No specific firmware or hardware revision information is included in the advisory, so all current units should be considered at risk until a corrective update is applied.

The CVSS base score of 3.7 indicates a low severity impact. The EPSS score of less than 1% suggests that the likelihood of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog, further reducing the probability of widespread exploitation. Based on the description, it is inferred that an attacker who can authenticate to the device or gain access through available interfaces could attempt to extract stored passwords. No specific remote attack vector is documented, so the risk to remote users is likely minimal unless additional network exposure exists.