RUGGEDCOM CROSSBOW CVE-2026-89197

Exploitation requires an authenticated account possessing the specific privileges needed to access and configure a Notification Profile; the injection point is the Value field of a notification condition processed during Notification Profile configuration, so the attacker must be able to reach that configuration workflow. This is network-reachable (AV:N) against affected RUGGEDCOM CROSSBOW instances running any version below V6.0, with no user interaction required. The primary limiting factor is the privilege prerequisite (PR:L) - unauthenticated outsiders cannot reach the vulnerable field - which narrows realistic exploitation to users who already hold valid, suitably-privileged credentials or attackers who have otherwise obtained them.

This is a credible, actionable priority rather than an inflated high-score issue, though not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-level authenticated privileges and no user interaction, with full high impact to confidentiality, integrity, and availability of the underlying database (VC:H/VI:H/VA:H) - consistent with a classic SQL injection (CWE-89). No EPSS score, CISA KEV listing, or public POC was provided in the source data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The limiting factor is the PR:L requirement: an attacker must already hold a valid account with the specific privileges needed to reach the Notification Profile configuration, which meaningfully reduces the exposed population to authenticated users (insiders or attackers who have obtained valid credentials). The signals are internally consistent - there is no conflict between the network vector and the description, which also describes remote, authenticated database access. Net: real risk for operators of affected RUGGEDCOM CROSSBOW instances given the full-impact database compromise, but the authentication prerequisite and absence of known exploitation argue for prompt-but-scheduled patching rather than crisis response.

An authenticated attacker holding an account with privileges to configure Notification Profiles submits a crafted value in the Value field of a notification condition, injecting SQL that the device executes against its backend database. By doing so they can read, modify, or destroy data in that database - for example extracting stored credentials or device/access records, or corrupting configuration state. No public exploit code was provided in the source data.