CVE-2026-89199: CWE-639: Authorization Bypass Through User-Controlled Key in Siemens RUGGEDCOM CROSSBOW

This vulnerability (CVE-2026-89199) in Siemens RUGGEDCOM CROSSBOW (versions before 6.0) involves improper restriction of access to sensitive configuration data through user-controlled keys in database queries. An authenticated attacker can exploit this to retrieve administrative credentials, resulting in unauthorized information disclosure and elevated privileges. The CVSS 3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data.

Exploitation allows an authenticated attacker to bypass authorization controls and access sensitive configuration items, including administrative credentials. This leads to unauthorized information disclosure and privilege escalation, potentially compromising internal systems' security and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted personnel only and monitor for suspicious query activity related to configuration database access.