CVE-2026-89197: SQL Injection
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the specific privileges needed to configure Notification Profiles. The issue is reachable through the Value field of notification conditions during Notification Profile configuration.
Are default deployments exposed?
The provided information does not establish whether the required Notification Profile configuration privileges are granted by default. Exposure depends on whether an attacker can obtain an authenticated account with those specific privileges.
What is the impact if exploitation succeeds?
A successful attacker can execute arbitrary SQL commands on the device's underlying database. The assigned vector indicates potential high impact to confidentiality, integrity, and availability.
Which versions need remediation?
All Siemens RUGGEDCOM CROSSBOW versions earlier than V6.0 are affected. Systems running V6.0 or later are not identified as affected in the provided data.