CVE-2026-2330 - Vulnerability Analysis

Overview

CROWN device contains a broken access control caused by incomplete whitelist enforcement in the REST interface, letting unauthenticated attackers modify critical device settings after reboot, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can modify critical device settings, potentially disrupting network and application configurations.

Mitigation

Update to the latest version with proper whitelist enforcement.

References

• https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
• https://www.sick.com/psirt
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• https://www.first.org/cvss/calculator/3.1
• https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.json
• https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 7, 2026

🚨 CRITICAL: CVE-2026-2330 in SICK Lector85x lets remote, unauthenticated attackers modify device configs via the CROWN REST interface. Patch or restrict access now to prevent OT compromise. https://radar.offseq.com/threat/cve-2026-2330-cwe-552-files-or-directories-accessi-493bd9c6 #OffSeq #ICS #Vulnerability #Infosec

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner