CVE-2026-89202

Siemens RUGGEDCOM CROSSBOW, a network management system used to administer RUGGEDCOM industrial switches and routers, fails to properly enforce authorization checks on device disconnection requests in all versions prior to V6.0. An attacker authenticated with only minimal privileges can issue disconnection requests that terminate the active sessions of other users, including administrators. The impact is denial of service — disrupting management visibility and operator control of the industrial network — with no direct confidentiality or integrity impact, reflected in a CVSS v4.0 score of 7.1 (high). Affected organizations are typically utilities, oil and gas, transportation, and other industrial operators running CROSSBOW servers below V6.0. There is no known public proof of concept and the vulnerability is not listed in CISA's KEV catalog, so exploitation is not known to be occurring.

What to do: Upgrade RUGGEDCOM CROSSBOW to V6.0 or later. Until patched, restrict access to the CROSSBOW server via network segmentation and allow-listing so only trusted management clients can reach it, review and minimize low-privilege user accounts, and monitor logs for abnormal session disconnection events.