CVE-2026-89202: CWE-639: Authorization Bypass Through User-Controlled Key in Siemens RUGGEDCOM CROSSBOW

This vulnerability in Siemens RUGGEDCOM CROSSBOW (versions before 6.0) arises from improper authorization checks on device disconnection requests. An authenticated attacker with low privileges can exploit this to disconnect other users' active sessions, including those of administrators, causing denial of service. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.

Exploitation allows an authenticated attacker with minimal privileges to forcibly disconnect active sessions of other users, including administrators. This results in denial of service by interrupting legitimate user access to the device. There is no direct confidentiality or integrity impact reported.

No official patch or remediation information is provided in the vendor advisory. Patch status is not yet confirmed — check Siemens advisories for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for unusual disconnection activity.