RUGGEDCOM CROSSBOW CVE-2026-89200

Exploitation requires an authenticated session with administrative privileges on RUGGEDCOM CROSSBOW (versions below V6.0) and access to the custom file label functionality, specifically the Name and Value input fields, which fail to validate or sanitize input. Limiting factors are significant: the attacker must already possess administrative credentials (PR:H) and local access (AV:L) per the vendor CVSS vector, no user interaction by a victim is needed (UI:N), and the fix is available in V6.0 and later. Because exploitation presupposes administrative control, the practical exposure is confined to insider threat, credential compromise, or post-authentication privilege abuse rather than external unauthenticated attack.

Signals point to a moderate, access-gated priority rather than an urgent mass-exploitation threat. The vendor-supplied CVSS 4.0 vector (base 8.4) encodes AV:L/AC:L/AT:N/PR:H/UI:N with full high impact to confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H), meaning the attacker must already be local and hold administrative privileges - a substantial precondition that caps real-world risk. There is no CISA KEV listing and no POC referenced in the provided intelligence, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified from this data. A notable tension: CWE-89 SQL injection flaws are frequently network-reachable (AV:N) through a management web interface, yet Siemens scored this AV:L - verify with the vendor whether the custom-file-label feature is reachable only via a local client/console or whether AV:L reflects a thick-client/local management assumption. The high privilege requirement (PR:H, administrative) is the dominant risk-limiting factor: an attacker who already holds admin on CROSSBOW has significant control, reducing the marginal impact of SQL injection, though it still enables database-level actions beyond the application's intended authorization model.

An attacker who has obtained administrative credentials to a RUGGEDCOM CROSSBOW instance (versions below V6.0) enters crafted SQL payloads into the Name or Value fields when creating or editing custom file labels. Because these inputs are not validated or sanitized, the payload is executed against the underlying database, allowing the attacker to read, modify, or destroy stored data. No public exploit code is identified at time of analysis, and the attack requires local access and administrative privileges per the CVSS vector.