An attacker can exploit weaknesses in the CROWN REST interface to bypass filesystem access controls. The incomplete whitelist allows access to directories intended for internal testing that are not protected by authentication. Once accessed, an attacker could upload a modified configuration file that activates after a system reboot, enabling changes to critical parameters such as network settings and application behavior. This could lead to unauthorized device operation, data exfiltration, or service disruption.

The vulnerability affects SICK AG products Lector83x and Lector85x. Specific firmware or release versions susceptible to this flaw are not listed, so all deployed instances of these devices should be considered potentially vulnerable until an official update is applied.

The flaw carries a CVSS score of 9.4, indicating very high severity. EPSS is reported as less than 1 %, suggesting a low current likelihood of exploitation, though the vulnerability remains present. It is not registered in the CISA KEV catalog. The attack vector is likely external or network‑based, leveraging the open CROWN REST endpoint without authentication. Successful exploitation would provide an attacker with full read/write access to the device’s configuration, effectively bypassing normal security controls.