RUGGEDCOM CROSSBOW before 6.0 allows SQL injection and credential theft
Authenticated attackers can run SQL, steal admin credentials, or change configuration; Siemens says to update to V6.0 or later.
62
CVE-2026-89196
SQL injection in Siemens RUGGEDCOM CROSSBOW import
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens RUGGEDCOM CROSSBOW before V6.0 fails to validate or sanitize facility names handled in the Bulk Import/Export workflow, which is SQL injection (CWE-89). An authenticated attacker who already has the specific privileges needed for that workflow can send crafted facility-name input over the network and run arbitrary SQL against the underlying database, with high impact to confidentiality, integrity, and availability of the vulnerable system (CVSS 4.0 8.7). No user interaction is required beyond the attacker’s own access. Every CROSSBOW release older than V6.0 is affected. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade RUGGEDCOM CROSSBOW to V6.0 or later. Until then, restrict accounts that can use Bulk Import/Export, and review facility-name import data and database logs for unexpected SQL.
| Product | Affected |
|---|---|
| Siemens RUGGEDCOM CROSSBOW | All versions < V6.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
- Weakness
- CWE-89
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X