CVE-2026-2330

CRITICAL 9.4

CVE-2026-2330

CVSS Score

9.4

EPSS Score

0.0%

EPSS Percentile

0th

An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.

CWE	CWE-552
Vendor	sick ag
Product	sick lector85x
Published	Mar 6, 2026
Last Updated	Mar 9, 2026

Stay Ahead of the Next One

Get instant alerts for sick ag sick lector85x

Be the first to know when new critical vulnerabilities affecting sick ag sick lector85x are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Affected Versions

SICK AG / SICK Lector85x

0 < 2.8.0

SICK AG / SICK Lector83x

0 < 2.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sick.com: https://www.sick.com/psirt sick.com: https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf cisa.gov: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices first.org: https://www.first.org/cvss/calculator/3.1 sick.com: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json sick.com: https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf