CVE-2026-89201: SQL Injection
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the specific privileges needed to use the Bulk Export workflow. Exploitation is network-accessible, but no user interaction is required.
Which inputs and workflow are involved?
The vulnerable inputs are device group names and facility names processed during Bulk Export. Improper validation or sanitization of those values can enable arbitrary SQL commands against the underlying database.
Which deployments are affected?
Siemens RUGGEDCOM CROSSBOW versions earlier than V6.0 are affected. The provided information does not state whether a default configuration grants the required Bulk Export privileges.
What can be done if an upgrade is not immediately possible?
The available information does not provide a vendor workaround. Restrict Bulk Export access and the specific privileges required to run it to trusted, necessary accounts until affected systems can be upgraded.