RUGGEDCOM CROSSBOW before 6.0 allows SQL injection and credential theft
Original title: Siemens RUGGEDCOM CROSSBOW
Authenticated attackers can run SQL, steal admin credentials, or change configuration; Siemens says to update to V6.0 or later.
CISA republished a Siemens advisory for RUGGEDCOM CROSSBOW versions before 6.0. Several flaws let an authenticated attacker with specific privileges run arbitrary SQL against the database. Another lets an authenticated user retrieve administrative credentials for internal systems and escalate privileges. Siemens’ fix is to update to V6.0 or later. The highest stated CVSS v3.1 score is 8.8.
Unconfirmed: The excerpt ends during CVE-2026-89201, so later CVE details are incomplete.
- Eleven CVEs are listed, from CVE-2026-89196 through CVE-2026-89206.
- CVE-2026-89196 is SQL injection via facility names in Bulk Import/Export, CVSS 8.8.
- CVE-2026-89199 is an authorization bypass that can expose administrative credentials, CVSS 8.8.
- CVE-2026-89200 requires administrative privileges and is scored 6.7.
- Deployments are described as worldwide across manufacturing, transport, energy, health, finance, and government.
Impact: SQL execution, admin credential theft, config changes, or denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW | < V6.0 | V6.0 or later |
- 1.Update RUGGEDCOM CROSSBOW to V6.0 or later.
- CVEs
- CVE-2026-89196CVE-2026-89197CVE-2026-89198CVE-2026-89199CVE-2026-89200CVE-2026-89201CVE-2026-89202CVE-2026-89203CVE-2026-89204CVE-2026-89205CVE-2026-89206
- Vendors
- Siemens
- Products
- RUGGEDCOM CROSSBOW
- Countries
- Germany
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89196 | SQL injection in Siemens RUGGEDCOM CROSSBOW import | 8.7 group max | — |
From the original article
11 min read at cisa.govView CSAF Summary RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.