CVE-2026-2330

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2330", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "state": "PUBLISHED", "assignerShortName": "SICK AG", "dateReserved": "2026-02-11T09:33:15.947Z", "datePublished": "2026-03-06T07:54:45.958Z", "dateUpdated": "2026-03-09T21:04:31.663Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "SICK Lector85x", "vendor": "SICK AG", "versions": [{"lessThan": "2.8.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "SICK Lector83x", "vendor": "SICK AG", "versions": [{"lessThan": "2.8.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.</p>"}], "value": "An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "environmentalScore": 9.4, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.4, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-03-06T07:54:45.958Z"}, "references": [{"tags": ["x_SICK PSIRT Security Advisories"], "url": "https://www.sick.com/psirt"}, {"tags": ["x_SICK Operating Guidelines"], "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"}, {"tags": ["x_ICS-CERT recommended practices on Industrial Security"], "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"tags": ["x_CVSS v3.1 Calculator"], "url": "https://www.first.org/cvss/calculator/3.1"}, {"tags": ["x_The canonical URL."], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json"}, {"tags": ["vendor-advisory"], "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Users are strongly recommended to upgrade to release version 2.8.0.</p>"}], "value": "Users are strongly recommended to upgrade to release version 2.8.0."}], "source": {"advisory": "SCA-2026-0006", "discovery": "INTERNAL"}, "title": "CVE-2026-2330", "x_generator": {"engine": "csaf2cve 0.2.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2330", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:56:25.769774Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T21:04:31.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2330", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:56:25.769774Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:58:06.423Z"}}], "cna": {"title": "CVE-2026-2330", "source": {"advisory": "SCA-2026-0006", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "temporalScore": 9.4, "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "temporalSeverity": "CRITICAL", "availabilityImpact": "HIGH", "environmentalScore": 9.4, "privilegesRequired": "NONE", "confidentialityImpact": "LOW", "environmentalSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SICK AG", "product": "SICK Lector85x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.8.0", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "SICK AG", "product": "SICK Lector83x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.8.0", "versionType": "custom"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Users are strongly recommended to upgrade to release version 2.8.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Users are strongly recommended to upgrade to release version 2.8.0.</p>", "base64": false}]}], "references": [{"url": "https://www.sick.com/psirt", "tags": ["x_SICK PSIRT Security Advisories"]}, {"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf", "tags": ["x_SICK Operating Guidelines"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["x_ICS-CERT recommended practices on Industrial Security"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["x_CVSS v3.1 Calculator"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json", "tags": ["x_The canonical URL."]}, {"url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "csaf2cve 0.2.1"}, "descriptions": [{"lang": "en", "value": "An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2026-03-06T07:54:45.958Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2330", "state": "PUBLISHED", "dateUpdated": "2026-03-09T21:04:31.663Z", "dateReserved": "2026-02-11T09:33:15.947Z", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "datePublished": "2026-03-06T07:54:45.958Z", "assignerShortName": "SICK AG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "SICK Lector85x", "vendor": "SICK AG", "versions": [{"lessThan": "2.8.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "SICK Lector83x", "vendor": "SICK AG", "versions": [{"lessThan": "2.8.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@sick.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters."}, {"lang": "es", "value": "Un atacante puede acceder a \u00e1reas restringidas del sistema de archivos en el dispositivo a trav\u00e9s de la interfaz REST de CROWN debido a una aplicaci\u00f3n incompleta de la lista blanca. Ciertos directorios destinados a pruebas internas no estaban cubiertos por la lista blanca y son accesibles sin autenticaci\u00f3n. Un atacante no autenticado podr\u00eda colocar un archivo de par\u00e1metros manipulado que se activa despu\u00e9s de un reinicio, permitiendo la modificaci\u00f3n de configuraciones cr\u00edticas del dispositivo, incluyendo la configuraci\u00f3n de red y los par\u00e1metros de la aplicaci\u00f3n."}], "id": "CVE-2026-2330", "lastModified": "2026-06-17T10:30:47.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "psirt@sick.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2330", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:56:25.769774Z", "version": "2.0.3"}}]}, "published": "2026-03-06T08:16:27.253", "references": [{"source": "psirt@sick.de", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"source": "psirt@sick.de", "url": "https://www.first.org/cvss/calculator/3.1"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"}, {"source": "psirt@sick.de", "url": "https://www.sick.com/psirt"}], "sourceIdentifier": "psirt@sick.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "psirt@sick.de", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SICK Lector83x", "source": "cna", "vendor": "SICK AG"}, "product": "sick_lector83x", "vendor": "sick_ag"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SICK Lector85x", "source": "cna", "vendor": "SICK AG"}, "product": "sick_lector85x", "vendor": "sick_ag"}], "analysis": {"en": {"generated_at": "2026-04-17T12:22:30.253683+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s patch by upgrading the device firmware to release version\u202f2.8.0.", "Configure network controls so the CROWN\u202fREST interface is only reachable from trusted internal networks or block it entirely if not required for operation.", "Audit filesystem and configuration file permissions to ensure that only authorized directories are exposed and that no test directories are accessible from the public interface, and review logs for suspicious file uploads."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized modification of device settings and potential network compromise"}, "threat_synthesis": {"affected_systems": "The vulnerability affects SICK AG products Lector83x and Lector85x. Specific firmware or release versions susceptible to this flaw are not listed, so all deployed instances of these devices should be considered potentially vulnerable until an official update is applied.", "description_and_impact": "An attacker can exploit weaknesses in the CROWN REST interface to bypass filesystem access controls. The incomplete whitelist allows access to directories intended for internal testing that are not protected by authentication. Once accessed, an attacker could upload a modified configuration file that activates after a system reboot, enabling changes to critical parameters such as network settings and application behavior. This could lead to unauthorized device operation, data exfiltration, or service disruption.", "risk_and_exploitability": "The flaw carries a CVSS score of 9.4, indicating very high severity. EPSS is reported as less than 1\u202f%, suggesting a low current likelihood of exploitation, though the vulnerability remains present. It is not registered in the CISA KEV catalog. The attack vector is likely external or network\u2011based, leveraging the open CROWN REST endpoint without authentication. Successful exploitation would provide an attacker with full read/write access to the device\u2019s configuration, effectively bypassing normal security controls."}}}}, "created": "2026-03-09T10:08:23.190060+00:00", "title": "CROWN\u202fREST File System Access and Injection Vulnerability in SICK Lector Devices", "updated": "2026-04-17T12:30:06.231494+00:00", "vendors": ["sick_ag", "sick_ag$PRODUCT$sick_lector83x", "sick_ag$PRODUCT$sick_lector85x"]}