RUGGEDCOM CROSSBOW CVE-2026-89201

Exploitation requires an authenticated session on RUGGEDCOM CROSSBOW (versions below V6.0) held by an account with the specific privileges needed to create or edit device group or facility names, and the malicious name must subsequently be processed through the Bulk Export workflow - the injection does not fire until that export runs. Limiting factors: valid credentials and name-editing privileges are mandatory (PR:L, not anonymous), high attack complexity (AC:H) implies additional non-default preconditions must be met for the payload to execute, and only installations still running a version prior to V6.0 are affected, which materially constrains realistic exploitation to insiders or attackers who have already compromised a user account.

This is a credentialed, moderate-priority vulnerability rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:N, VC/VI/VA:H, score 7.7) shows a network-reachable but condition-dependent attack: AC:H indicates the attacker must meet non-trivial preconditions, and PR:L confirms valid authenticated access with specific privileges is required - this is not an anonymous remote RCE. The high confidentiality, integrity, and availability impacts are consistent with CWE-89 SQL injection granting broad control over the backend database. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals, combined with PR:L and AC:H, points to this being an insider/post-authentication risk in a niche OT product rather than an internet-scale threat. One caveat: the CVSS 4.0 vector omits subsequent-system impact (SC/SI/SA:N) even though SQLi can sometimes pivot beyond the application DB - real-world blast radius depends on database privileges and deployment, which the advisory does not detail.

A low-privileged but authenticated RUGGEDCOM CROSSBOW user who can define or edit device group or facility names embeds SQL syntax into one of those name fields. When an operator (or the attacker) runs the Bulk Export workflow, the unsanitized name is concatenated into a database query and executed, letting the attacker read, modify, or destroy data in the underlying database. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means the injection must satisfy specific preconditions to succeed.