CVE-2026-89200: SQL Injection
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated attacker with administrative privileges on an affected RUGGEDCOM CROSSBOW device. It is locally exploitable and does not require user interaction.
Which deployments are affected?
All RUGGEDCOM CROSSBOW versions earlier than V6.0 are affected. The issue is in the Name and Value fields used for custom file labels.
What could an attacker do after exploiting it?
An attacker could execute arbitrary SQL commands on the device's underlying database. The reported impact includes confidentiality, integrity, and availability compromise.