Summary
RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version.
The following versions of Siemens RUGGEDCOM CROSSBOW are affected:
- RUGGEDCOM CROSSBOW vers:intdot/<6.0 (CVE-2026-89196, CVE-2026-89197, CVE-2026-89198, CVE-2026-89199, CVE-2026-89200, CVE-2026-89201, CVE-2026-89202, CVE-2026-89203, CVE-2026-89204, CVE-2026-89205, CVE-2026-89206)
CVSS
Vendor
Equipment
v3 8.8
Siemens
RUGGEDCOM CROSSBOW
4 Vulnerabilities
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Authorization Bypass Through User-Controlled Key, Insertion of Sensitive Information Into Sent Data, Client-Side Enforcement of Server-Side Security
Background
- Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2026-89196
Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
Read More
1 Affected Product
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
Additional Metrics
Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Version
Base Score
Base Severity
Vector String
3.1
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-89197
Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
Read More
2 Affected Products
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
Additional Metrics
Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Version
Base Score
Base Severity
Vector String
3.1
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-89198
Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
Read More
3 Affected Products
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
Additional Metrics
Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Version
Base Score
Base Severity
Vector String
3.1
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-89199
Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.
Read More
4 Affected Products
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
RUGGEDCOM CROSSBOW < V6.0
Product Status: known_affected
Remediations
Vendor fix
Update to V6.0 or later version
Additional Metrics
Relevant CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS Version
Base Score
Base Severity
Vector String
3.1
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-89200
Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: