CVE-2026-89197: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Siemens RUGGEDCOM CROSSBOW

This vulnerability in Siemens RUGGEDCOM CROSSBOW (versions before 6.0) involves improper neutralization of special elements used in SQL commands (CWE-89). Specifically, the Value field of notification conditions processed during Notification Profile configuration does not properly validate or sanitize input. This allows an authenticated attacker with the necessary privileges to execute arbitrary SQL commands on the device's underlying database, leading to high impact on confidentiality, integrity, and availability as reflected by a CVSS 3.1 score of 8.8.

Successful exploitation allows an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. This can lead to unauthorized data disclosure, modification, or deletion, and potentially disrupt device operation, impacting confidentiality, integrity, and availability of the system.

A fix is available in Siemens RUGGEDCOM CROSSBOW version 6.0 and later. Users should upgrade to version 6.0 or above to remediate this vulnerability. No vendor advisory content was provided beyond version information, so patch status is confirmed by versioning. Until upgrade, restrict access to authorized users with specific privileges and monitor for suspicious activity related to Notification Profile configuration.