SQL Injection Flaw in RUGGEDCOM CROSSBOW by Siemens
CVE-2026-89197

8.7HIGH

Key Information:

Vendor

Siemens
Status
Ruggedcom Crossbow
Vendor
CVE Published:
13 October 2026

What is CVE-2026-89197?

A vulnerability exists in RUGGEDCOM CROSSBOW that allows an authenticated attacker with the right privileges to bypass input validation and execute arbitrary SQL commands. This flaw is found in the Value field of notification conditions during Notification Profile configuration, potentially compromising the integrity of the underlying database. Users are advised to upgrade to version 6.0 or higher to mitigate this risk.

Affected Version(s)

RUGGEDCOM CROSSBOW 0

References

https://cert-portal.siemens.com/productcert/html/ssa-5085...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.