CVE-2026-89196: SQL Injection
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and have the specific privileges needed to use the Bulk Import/Export workflow. The issue is remotely reachable over the network and does not require user interaction.
Which deployments are affected?
All Siemens RUGGEDCOM CROSSBOW versions earlier than V6.0 are affected. The available information does not state whether the required Bulk Import/Export privileges are granted in a default configuration.
What is the potential impact of successful exploitation?
A successful attacker can execute arbitrary SQL commands on the underlying database. The stated impact includes high confidentiality, integrity, and availability consequences.
How can I determine whether my environment is exposed?
Identify RUGGEDCOM CROSSBOW instances running a version earlier than V6.0, then review which accounts have privileges for the Bulk Import/Export workflow. Devices meeting both conditions should be treated as exposed to an authenticated attacker with those privileges.