RUGGEDCOM CROSSBOW CVE-2026-89198

Exploitation requires an authenticated CROSSBOW account possessing the specific privilege to upload firmware files to the system (PR:L), and the attacker must craft the uploaded firmware file's FILENAME to contain SQL injection payloads - the vulnerable path is filename validation/sanitization, not the file contents. Limiting factors: valid credentials with firmware-upload rights are mandatory (not exploitable pre-authentication), the product is a specialized OT access-management server usually deployed on segmented management networks, and all versions below V6.0 are affected (upgrade to V6.0+ removes exposure). No user interaction by a second party is required (UI:N).

This is a credible but not top-tier priority. The input CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:L/UI:N, full VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity SQL injection that requires an authenticated attacker holding 'specific privileges' (PR:L) - so it is NOT remote-unauthenticated. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, placing this in the 'no public exploit identified' category rather than active exploitation. The signals are internally consistent (CWE-89 SQLi, PR:L authentication, high confidentiality/integrity/availability impact to the database), so there is no contradiction between vector and description. The gating factor is that an attacker must already possess valid credentials with firmware-upload rights on a RUGGEDCOM CROSSBOW access-management server, which is typically a hardened OT/substation management component. Net assessment: a genuine high-severity flaw worth patching on management systems, but the authentication requirement and the absence of KEV/EPSS/POC evidence mean it is not an emergency drive-by threat; prioritize based on how exposed the CROSSBOW management interface is and how tightly upload privileges are controlled.

An attacker who has obtained an authenticated CROSSBOW account with firmware-upload privileges (e.g., a compromised or malicious operator) uploads a firmware file whose filename is crafted to embed SQL syntax. Because the filename is not sanitized before use in a database query, the injected SQL executes against the underlying database, allowing the attacker to read, modify, or destroy data. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means a working payload is straightforward to construct once access is obtained.