CVE-2026-89198: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Siemens RUGGEDCOM CROSSBOW

This vulnerability (CVE-2026-89198) in Siemens RUGGEDCOM CROSSBOW versions before 6.0 allows an authenticated user with certain privileges to perform SQL injection via the filename of uploaded firmware files. The lack of proper validation or sanitization of the filename input leads to improper neutralization of special elements used in SQL commands (CWE-89). Exploitation could result in arbitrary SQL command execution on the backend database.

Successful exploitation could lead to full compromise of the database, including unauthorized disclosure, modification, or deletion of data, and potential disruption of device functionality. The CVSS 3.1 base score of 8.8 reflects high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.

A fix is available in Siemens RUGGEDCOM CROSSBOW version 6.0 and later. Users should upgrade to version 6.0 or above to remediate this vulnerability. Until the upgrade is applied, restrict access to the firmware upload functionality to trusted users only and monitor for suspicious activity related to firmware uploads. Patch status beyond this is not explicitly stated; check Siemens advisories for updates.