RUGGEDCOM CROSSBOW CVE-2026-89206

Exploitation requires an authenticated session on RUGGEDCOM CROSSBOW with at least minimal/low privileges (PR:L), and targets the server-side authorization logic governing modification of scheduled actions - the server fails to re-check authorization for retry/stop/delete operations on scheduled tasks. No special non-default configuration or user interaction is required (UI:N), and all versions below V6.0 are affected. The key limiting factor is the need for valid low-privilege credentials: this cannot be exploited by a fully unauthenticated remote attacker, which materially narrows the realistic threat to insiders or attackers who have already obtained a low-tier CROSSBOW account.

This is a moderate-severity broken-authorization flaw (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) in Siemens RUGGEDCOM CROSSBOW, confirmed and reported by Siemens via advisory SSA-508506. The CVSS vector indicates network-reachable, low-complexity exploitation but explicitly requires existing privileges (PR:L), so this is an authenticated privilege/authorization-bypass issue, not a remote-unauthenticated one. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public proof-of-concept, so there is no evidence of active or imminent widespread exploitation - the real-world urgency is lower than the 'network' attack vector alone might suggest. SSVC-style reasoning supports a low-to-moderate priority: technical impact is partial (the attacker can only manipulate scheduled-task state, each impact rated Low), it is not obviously automatable since it needs valid credentials, and exploitation is only theoretically possible at analysis time. Note a conflict in the input metadata: the vulnerability is tagged 'Information Disclosure', but the description (CWE-602, unauthorized retry/stop/delete of scheduled tasks) describes a missing server-side authorization / integrity-and-availability issue, not disclosure - verify tagging against the Siemens advisory. Net: a legitimate but lower-tier patch item, primarily relevant where low-privilege CROSSBOW accounts are widely provisioned.

An attacker who already holds a low-privilege RUGGEDCOM CROSSBOW account (for example a limited operator or a compromised minimal-access credential) sends requests to the server to retry, stop, or delete scheduled tasks that their role should not be allowed to modify, because the server fails to enforce authorization and relies on client-side enforcement (CWE-602). No public exploit code was identified at time of analysis, and exploitation requires a valid authenticated session, which limits the realistic attacker pool.