Vulnerability in Sick Ag Lector83x
CVE-2026-2330
An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.
EPSS: 0.007 (48.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.
Affected products
- Sick Ag Lector83x — versions 0
- Sick Ag Lector85x — versions 0
Weakness classification (CWE)
References
- psirt@sick.de (x_SICK PSIRT Security Advisories)
- psirt@sick.de (x_SICK Operating Guidelines)
- psirt@sick.de (x_ICS-CERT recommended practices on Industrial Security)
- psirt@sick.de (x_CVSS v3.1 Calculator)
- psirt@sick.de (x_The canonical URL.)
- psirt@sick.de (vendor-advisory)
Frequently asked questions
- What is CVE-2026-2330?
- CVE-2026-2330 is a critical-severity vulnerability in Sick Ag Lector83x, classified under Files or Directories Accessible to External Parties. CVSS score: 9.4/10. Published 2026-03-06.
- How severe is CVE-2026-2330?
- Critical severity. CVSS v3 base score is 9.4 out of 10.