CVE-2026-89199: High severity Siemens Ruggedcom Crossbow vulnerability
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the affected RUGGEDCOM CROSSBOW device. No user interaction is required, and the attack can be performed over the network.
What could an attacker obtain or do?
An authenticated attacker could use specific database queries to retrieve administrative credentials for various internal systems. Those credentials could enable unauthorized information disclosure and privilege escalation.
Which deployments are affected?
All Siemens RUGGEDCOM CROSSBOW versions earlier than V6.0 are affected. The provided information does not identify any configuration prerequisite or default-configuration exception.