RUGGEDCOM CROSSBOW CVE-2026-89205

Exploitation requires an authenticated account on RUGGEDCOM CROSSBOW with at least minimal privileges (PR:L) and network reachability to the CROSSBOW server (AV:N); no user interaction is needed. The specific abused function is the request path that schedules 'special operations' on managed devices, where the server omits server-side authorization re-validation (CWE-602) and trusts client-enforced permissions. Limiting factors: the attacker must already possess valid (even if low-privilege) credentials and network access to the management interface, so unauthenticated internet exploitation is not possible; impact is bounded by what scheduled 'special operations' can affect on managed devices. All versions below V6.0 are affected; upgrading to V6.0 or later removes the condition.

This is a moderate-severity authorization flaw (CVSS 6.3, vendor-assigned by Siemens) in RUGGEDCOM CROSSBOW, mapped to CWE-602 (Client-Side Enforcement of Server-Side Security). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation requiring low existing privileges (PR:L, i.e. an authenticated low-privileged account) with no user interaction, yielding limited confidentiality, integrity, and availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation is characterized as 'no public exploit identified at time of analysis.' The signals are internally consistent: a low-privilege authenticated attacker can escalate their effective capability by scheduling operations they are not authorized to perform, because the server fails to re-validate authorization. This is a genuine privilege/authorization-boundary issue rather than an inflated high-CVSS score, but its real-world urgency is tempered by the authentication prerequisite and the limited (partial) impact ratings. The primary mitigating factor is the lack of evidence of active exploitation combined with the niche, access-controlled OT deployment context; the primary aggravating factor is that CROSSBOW manages access to critical substation/industrial infrastructure, so unauthorized scheduled operations could have outsized operational consequences despite the modest CVSS impact metrics. Prioritize patching, but this is not an emergency-tier flaw in the absence of KEV/POC signals.

A low-privileged but authenticated CROSSBOW user (or an attacker who has obtained such credentials) sends a crafted request to schedule a special operation that their role should not permit. Because the server relies on client-side enforcement and does not re-check authorization server-side, the operation is accepted and queued against managed devices. No public exploit code is known, but the low attack complexity (AC:L) means a knowledgeable insider or credential-holder could reproduce this reliably.