This critical vulnerability in SICK AG TDC-X401GL allows authenticated attackers to gain unauthorized access to the host filesystem, posing a severe risk of system compromise.

The flaw is classified as CWE-266 (Incorrect Privilege Assignment). It allows an authenticated user with low privileges (PR:L) to perform unauthorized operations on the host filesystem with elevated impact, as indicated by the Scope:Changed (S:C) vector.

Successful exploitation allows an attacker to read and modify critical system data, potentially leading to a total loss of confidentiality, integrity, and availability. With a CVSS score of 9.9, this vulnerability represents a severe risk to operational technology environments, necessitating immediate attention to prevent unauthorized system control or data tampering.

Immediate Action: Upgrade the TDC-X401GL firmware to version 1.4.0 or the latest available release as specified by SICK AG.

Proactive Monitoring: Monitor system logs for unauthorized file access patterns or unexpected administrative configuration changes originating from low-privileged accounts.

Compensating Controls: Ensure the device is isolated within a secure network segment (VLAN) with strict firewall rules to limit access to only necessary management interfaces.

Public Exploit Available: Unknown.

Given the critical CVSS severity of 9.9 and the potential for total system compromise, organizations currently utilizing SICK AG TDC-X401GL devices must prioritize the firmware update to version 1.4.0. Failure to patch these systems leaves them exposed to significant operational and security risks.