RUGGEDCOM CROSSBOW before 6.0 allows SQL injection and credential theft
Authenticated attackers can run SQL, steal admin credentials, or change configuration; Siemens says to update to V6.0 or later.
62
CVE-2026-89201
Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW
- CVSS 4.0
- 7.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens RUGGEDCOM CROSSBOW before V6.0 does not properly validate or sanitize device group or facility names used in the Bulk Export workflow, allowing SQL injection (CWE-89). An authenticated attacker who already has the required privileges can send crafted names over the network and run arbitrary SQL against the underlying database. Successful exploitation can fully compromise confidentiality, integrity, and availability of that database (CVSS 4.0 base 7.7), though attack complexity is rated high and privileges are required. All CROSSBOW releases earlier than V6.0 are affected. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade RUGGEDCOM CROSSBOW to V6.0 or later. Until then, limit Bulk Export and device-group or facility-name privileges to trusted administrators, and keep the management interface off untrusted networks.
| Product | Affected |
|---|---|
| Siemens RUGGEDCOM CROSSBOW | All versions < V6.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
- Weakness
- CWE-89
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X