Threat Intelligence Database

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.

CVE-2026-89201 is a SQL Injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw arises from improper validation or sanitization of input in device group or facility names during the Bulk Export workflow. An authenticated attacker with specific privileges could exploit this to execute arbitrary SQL commands on the underlying database. The vulnerability has a high severity rating with a CVSS score of 7.5. No patch or remediation details are currently provided.

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

CVE-2026-89196 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw arises from improper validation or sanitization of input in facility names during the Bulk Import/Export workflow. An authenticated attacker with specific privileges could exploit this to execute arbitrary SQL commands on the underlying database, potentially compromising confidentiality, integrity, and availability.