Vulnerability in Sick Ag Lector83x
CVE-2026-2330
An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (49.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 49.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Sick Ag Lector83x — versions 0
- Sick Ag Lector85x — versions 0
Weakness classification (CWE)
References
- www.sick.com/psirt (x_SICK PSIRT Security Advisories)
- www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_… (x_SICK Operating Guidelines)
- www.cisa.gov/resources-tools/resources/ics-recommended-practices (x_ICS-CERT recommended practices on Industrial Security)
- www.first.org/cvss/calculator/3.1 (x_CVSS v3.1 Calculator)
- www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json (x_The canonical URL.)
- www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf (vendor-advisory)
Frequently asked questions
- What is CVE-2026-2330?
- CVE-2026-2330 is a critical-severity vulnerability in Sick Ag Lector83x, classified under Files or Directories Accessible to External Parties. CVSS score: 9.4/10. Published 2026-03-06.
- How severe is CVE-2026-2330?
- Critical severity. CVSS v3 base score is 9.4 out of 10.