PT-2026-23659 · Crown · Crown

Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-2330

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions CROWN versions (affected versions not specified)

Description An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters. The vulnerability allows modification of critical device settings via the CROWN REST interface. The vulnerable component is the whitelist enforcement mechanism within the CROWN REST interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2026-2330

Affected Products

Crown

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-2330 · Security Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0006.pdf · Vendor Advisory
• https://twitter.com/cracbot/status/2031686877653397785 · Twitter Post
• https://sick.com/psirt · Note
• https://twitter.com/CveFindCom/status/2029839808072196339 · Twitter Post
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Note
• https://twitter.com/TheHackerWire/status/2029835143880527983 · Twitter Post
• https://twitter.com/cyberbivash/status/2029837141044347189 · Twitter Post
• https://first.org/cvss/calculator/3.1 · Note
• https://t.me/CVEtracker/46583 · Telegram Post
• https://twitter.com/the_yellow_fall/status/2031192140466790607 · Twitter Post
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0006.json · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://twitter.com/CVEnew/status/2029975541265354830 · Twitter Post