CVE-2026-2330 CVE-2026-2330
Unauthenticated attackers can access restricted filesystem areas and modify critical device settings via the CROWN REST interface due to incomplete whitelist enforcement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2330?
CVE-2026-2330 is a critical path traversal vulnerability in SICK Lector83x, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.
Weakness: CWE-552
Which versions are affected by CVE-2026-2330?
How do I fix CVE-2026-2330?
No fix has been published for CVE-2026-2330 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-2330 being exploited?
There is no known exploitation of CVE-2026-2330 in the wild and no public exploit code.
Sources
Also known as GHSA-xmqp-rgcq-rmm2.