Ruggedcom Crossbow Secure Access Manager Primary Sam P CVE-2026-27668

Attacker must be an authenticated User Administrator in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions below V5.8. The attacker exploits the default behavior where User Administrators can administer groups they belong to, escalating privileges without victim interaction.

Real-world risk is HIGH for environments with untrusted User Administrators or compromised low-privilege accounts. CVSS 8.8 accurately reflects severity: network attack vector (AV:N) enables remote exploitation, low complexity (AC:L) requires no specialized conditions, low privileges required (PR:L) means any User Administrator account suffices, and no user interaction (UI:N) enables fully automated exploitation. The unchanged scope (S:U) indicates the vulnerability remains within the SAM-P application boundary, but complete CIA impact (C:H/I:H/A:H) represents total compromise of access control integrity. While no public exploit or CISA KEV listing exists, the attack logic is trivial for authenticated insiders or lateral movement scenarios following initial compromise. In industrial control system (ICS) contexts, privilege escalation to full administrative access could enable manipulation of critical device configurations, operational disruption, or safety system interference. Organizations with strict separation-of-duties policies face immediate risk, as a single compromised User Administrator account bypasses all intended privilege boundaries. The vulnerability is particularly dangerous in environments where User Administrator credentials might be held by third-party integrators, managed service providers, or field technicians who should not possess full system control.

An attacker with compromised User Administrator credentials authenticates to the SAM-P web interface from a network-accessible location. Leveraging the group administration functionality intended for managing groups they belong to, the attacker iteratively adds themselves to progressively higher-privileged device groups, ultimately assigning themselves to the top-level administrative group with unrestricted access. With elevated privileges, the attacker can now reconfigure critical industrial network devices, modify access policies for operational technology systems, or establish persistent backdoor accounts across the managed infrastructure, all without detection through normal privilege boundaries.