CVE-2026-89199

Siemens RUGGEDCOM CROSSBOW before V6.0 does not properly restrict access to sensitive configuration items when specific database queries are issued. An authenticated attacker with low privileges can use those queries over the network, without user interaction, to retrieve administrative credentials for various internal systems. Stolen credentials can lead to unauthorized information disclosure and privilege escalation, with high impact to confidentiality, integrity, and availability of the vulnerable system. All CROSSBOW versions older than V6.0 are affected. There is no known public proof of concept, and the issue is not listed in CISA KEV.

What to do: Upgrade RUGGEDCOM CROSSBOW to V6.0 or later. Until then, limit network access to the management interface to trusted administrators, review database and application logs for unusual configuration queries, and rotate administrative credentials for internal systems that CROSSBOW could have disclosed.