What is the CVSS score of CVE-2026-2330?

CVE-2026-2330 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-2330?

Within 24 hours: Identify all systems running CROWN REST interface and assess which contain sensitive data; implement network-level access controls to restrict CROWN REST traffic to trusted internal networks only. Within 7 days: Deploy WAF rules to enforce strict input validation and rate limiting on REST endpoints; conduct audit of access logs for suspicious activity. Within 30 days: Work with vendor for patch availability timeline; evaluate alternative solutions or full service isolation if patch remains unavailable; implement continuous monitoring for exploitation attempts.

CVE-2026-2330

CRITICAL

Files or Directories Accessible to External Parties (CWE-552)

2026-03-06 psirt@sick.de

Path Traversal Information Disclosure

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 08:16 nvd

CRITICAL 9.4

DescriptionCVE.org

An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.