RUGGEDCOM CROSSBOW before 6.0 allows SQL injection and credential theft
Authenticated attackers can run SQL, steal admin credentials, or change configuration; Siemens says to update to V6.0 or later.
62
CVE-2026-89197
Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens RUGGEDCOM CROSSBOW before V6.0 has a SQL injection flaw (CWE-89) in the Value field of notification conditions used when configuring a Notification Profile. An authenticated attacker who already has the privileges needed to change that configuration can send unsanitized input that the product executes as arbitrary SQL against the underlying database. Successful exploitation can fully compromise confidentiality, integrity, and availability of data on the affected system (CVSS 4.0 base 8.7). The issue affects every RUGGEDCOM CROSSBOW release older than V6.0. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade RUGGEDCOM CROSSBOW to V6.0 or later. Until then, restrict accounts that can edit Notification Profiles, limit network access to the management interface, and review database and application logs for unexpected SQL in notification condition values.
| Product | Affected |
|---|---|
| Siemens RUGGEDCOM CROSSBOW | All versions < V6.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
- Weakness
- CWE-89
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X