RUGGEDCOM CROSSBOW CVE-2026-89202

Exploitation requires a valid RUGGEDCOM CROSSBOW account with at least minimal privileges (PR:L) and network reachability to the application's device-disconnection function; no user interaction is needed. The core enabling condition is that the application does not authorization-check device-disconnection requests, so any authenticated user can target sessions belonging to other users or administrators. Limiting factors: the attacker must first obtain credentials (no unauthenticated path), impact is confined to availability/denial of service (sessions are dropped, not data compromised), and only deployments running versions below V6.0 are affected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: a network-reachable, low-complexity attack requiring low privileges (PR:L) and no user interaction, impacting availability only (VA:H) with no confidentiality or integrity effect. This is a broken-authorization / IDOR-class issue (CWE-639), NOT a true authentication bypass - the attacker must already hold a valid, minimally-privileged account. No EPSS score, KEV listing, or POC indicator is present in the input, so exploitation likelihood cannot be quantified from these sources; there is no public exploit identified at time of analysis. Realistically this is a moderate-priority operational-availability issue rather than a critical remote-code-execution threat: the impact ceiling is denial of service (forcibly disconnecting other users' sessions, including administrators), and the PR:L prerequisite limits it to insiders or attackers who have already obtained credentials. For an industrial/OT access-management product the availability impact is non-trivial, so it warrants prompt patching, but the absence of confidentiality/integrity impact and the authentication prerequisite place it below internet-facing unauthenticated flaws in triage order.

An attacker holding a low-privilege RUGGEDCOM CROSSBOW account (for example a rogue operator or a user whose credentials were phished) issues a device-disconnection request that the application fails to authorization-check against the target session. By repeatedly disconnecting other users' and administrators' active sessions, the attacker denies legitimate operators access to managed substation devices. No public exploit code is identified at time of analysis, and because privileges are required (PR:L), the attacker must first obtain a valid account.