CVE-2026-89203: CWE-201: Insertion of Sensitive Information Into Sent Data in Siemens RUGGEDCOM CROSSBOW

The vulnerability identified as CVE-2026-89203 in Siemens RUGGEDCOM CROSSBOW (all versions before 6.0) involves improper access control on database queries. Authenticated attackers with limited privileges can exploit this flaw to extract sensitive information about the system’s infrastructure, including comprehensive details on devices, substations, users, and scheduled activities. The issue is classified under CWE-201, indicating insertion of sensitive information into sent data. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges but no user interaction, resulting in limited confidentiality impact without affecting integrity or availability.

An authenticated attacker with low privileges can retrieve sensitive system information that should be restricted, potentially aiding further reconnaissance or targeted attacks. However, there is no direct impact on system integrity or availability. The confidentiality breach could expose infrastructure details that might be leveraged in subsequent attack phases.

No official patch or remediation information is provided in the vendor advisory or the CVE data. Patch status is not yet confirmed — check Siemens' official advisory for current remediation guidance. Until a fix is available, restrict access to the affected RUGGEDCOM CROSSBOW systems to trusted users only and monitor for unauthorized access attempts.