CVE-2026-89196: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Siemens RUGGEDCOM CROSSBOW

This vulnerability (CWE-89) in Siemens RUGGEDCOM CROSSBOW versions before 6.0 allows an authenticated user with certain privileges to inject malicious SQL commands via facility name inputs processed in the Bulk Import/Export workflow. The lack of proper input validation or sanitization enables arbitrary SQL execution on the backend database, which can lead to full compromise of the database contents and system functionality. The CVSS 3.1 score is 8.8, indicating high impact with network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality, integrity, and availability impacts.

Successful exploitation can result in arbitrary SQL command execution on the device's database, leading to potential data disclosure, data modification, or denial of service. This compromises the confidentiality, integrity, and availability of the affected system. The attacker must be authenticated and have specific privileges, limiting the attack surface to authorized users.

A fix is available in version 6.0 of Siemens RUGGEDCOM CROSSBOW. Users should upgrade to version 6.0 or later to remediate this vulnerability. Until upgrading, restrict access to the Bulk Import/Export functionality to trusted users only and monitor for suspicious activity. Patch status is confirmed by the vendor's versioning information.