CVE-2026-89203: Medium severity Siemens Ruggedcom Crossbow vulnerability
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
All Siemens RUGGEDCOM CROSSBOW versions earlier than V6.0 are affected.
What access does an attacker need to exploit this issue?
An attacker must already be authenticated with a user account. No user interaction is required, and the issue can be exploited over the network.
What information could be exposed?
A lower-privileged authenticated user may retrieve system-wide information beyond their intended privilege level, including details about devices, substations, users, and scheduled activities.
What should be done to remediate the issue?
Upgrade affected RUGGEDCOM CROSSBOW installations to V6.0 or later.