RUGGEDCOM CROSSBOW before 6.0 allows SQL injection and credential theft
Authenticated attackers can run SQL, steal admin credentials, or change configuration; Siemens says to update to V6.0 or later.
62
CVE-2026-89200
SQL injection in Siemens RUGGEDCOM CROSSBOW
- CVSS 4.0
- 8.4 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens RUGGEDCOM CROSSBOW before V6.0 has an SQL injection flaw (CWE-89) because the Name and Value fields used for custom file labels are not properly validated or sanitized. An authenticated attacker who already has administrative privileges can submit crafted input in those fields and run arbitrary SQL commands against the product’s underlying database. Successful exploitation can disclose, change, or destroy database contents, with high impact on confidentiality, integrity, and availability; CVSS 4.0 rates it 8.4 and scores the attack vector as local. All CROSSBOW releases earlier than V6.0 are affected. It is not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Upgrade RUGGEDCOM CROSSBOW to V6.0 or later. Until then, restrict administrative access to trusted operators, review custom file-label Name and Value entries for unexpected SQL, and monitor the underlying database for unauthorized queries.
| Product | Affected |
|---|---|
| Siemens RUGGEDCOM CROSSBOW | All versions < V6.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.
- Weakness
- CWE-89
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X