RUGGEDCOM CROSSBOW CVE-2026-89204

Exploitation requires an existing authenticated session on RUGGEDCOM CROSSBOW (All versions < V6.0) and access to the subnet-management functionality, which relies on database queries that do not enforce proper per-object authorization (CWE-639). The limiting factors are significant: the attacker must already possess valid credentials (PR:L) - there is no anonymous/unauthenticated path - and impact is confined to subnet configuration data (read/modify/delete), with no availability impact. The flaw is addressed in V6.0 and later, so upgrading removes the condition. Deployment is restricted to Siemens OT/substation environments running this specific management platform.

This is a moderate-severity authorization flaw (CVSS 5.4) rather than a high-urgency priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N shows a network-reachable, low-complexity issue, but critically it requires existing authentication (PR:L) and yields only partial confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N). The CWE-639 classification (Authorization Bypass Through User-Controlled Key / IDOR) is consistent with the description of improperly restricted database queries for subnet management - an authenticated user can reach data/functions they should not. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable near-term exploitation; this reads as a targeted post-authentication risk, not a mass-exploitable remote flaw. Note a mild signal tension: the input Tags include 'Authentication Bypass,' which conflicts with both the CWE-639 authorization semantics and the PR:L (authentication required) vector - this is an authorization/IDOR issue affecting already-authenticated users, not a bypass of authentication itself. Overall priority is low-to-moderate, weighted by the OT/critical-infrastructure context of the affected product.

An attacker who already holds valid (even low-privileged) credentials on a RUGGEDCOM CROSSBOW instance sends crafted requests to the subnet-management functions, whose underlying database queries do not properly check authorization. By manipulating object identifiers, the attacker reads, alters, or deletes subnet configurations belonging to other scopes, disclosing network layout information and tampering with access-management data. No public exploit code was identified at time of analysis, and exploitation requires prior authentication.