CVE-2026-89198: SQL Injection
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Siemens RUGGEDCOM CROSSBOW devices running versions earlier than V6.0 are affected. The provided information does not identify any unaffected configuration among those versions.
What access does an attacker need to exploit this issue?
An attacker must be authenticated to the device and hold the specific privileges required to upload firmware files. User interaction is not required, and the attack can be performed over the network.
What is the potential impact if exploitation succeeds?
The attacker could execute arbitrary SQL commands on the underlying database. The reported impact includes high confidentiality, integrity, and availability impact.