An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories inten…

CVE-2026-2330 describes a critical vulnerability in SICK devices where the CROWN REST interface has incomplete whitelist enforcement. Unauthenticated attackers can access restricted filesystem areas, particularly directories intended for internal testing that were not properly protected by the whitelist. This allows attackers to place manipulated parameter files that become active after device reboot, enabling modification of critical device settings including network configuration and application parameters. The vulnerability affects industrial control systems and poses significant risks to operational technology environments.