RUGGEDCOM CROSSBOW CVE-2026-89196

Exploitation requires an authenticated account holding the specific privileges needed to use the Bulk Import/Export workflow in RUGGEDCOM CROSSBOW (all versions < V6.0); the attacker injects SQL through unsanitized facility name fields processed during that import/export operation. Limiting factors: valid privileged credentials are mandatory (PR:L - this is not unauthenticated), and the attack path is confined to the Bulk Import/Export facility-name handling rather than any arbitrary request, so an attacker lacking that workflow privilege cannot reach the vulnerable code.

This is a genuine but access-gated priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 8.7 base score reflect network-reachable, low-complexity SQL injection (CWE-89) with high confidentiality, integrity, and availability impact on the backend database - serious because RUGGEDCOM CROSSBOW manages privileged access to industrial/substation infrastructure. However, PR:L confirms an attacker must already hold valid, specifically-privileged credentials, which meaningfully narrows the threat population versus a PR:N flaw and points toward insider or post-compromise abuse rather than opportunistic mass exploitation. No EPSS probability, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or widespread exploitation at this time; exploitation status is therefore 'no public exploit identified at time of analysis.' There are no conflicting signals here - the single Siemens advisory is the only source - but the ICS/OT deployment context means that even a credentialed-only bug can be high-consequence where it is deployed. Overall: patch promptly in OT environments, but it is not an internet-wide emergency.

An authenticated operator or attacker who has obtained an account with the required Bulk Import/Export privileges submits an import containing a crafted facility name embedding SQL syntax. Because the input is not validated or sanitized, the payload is executed against the underlying database, letting the attacker read, modify, or destroy access-management data. No public exploit code is identified at time of analysis, and exploitation requires low attack complexity but valid privileged credentials.