RUGGEDCOM CROSSBOW EUVD-2026-98401

Exploitation requires a valid authenticated session to RUGGEDCOM CROSSBOW (PR:L) with network reachability to the application; it is not remote-unauthenticated. The specific condition is that the attacker must be a legitimate but lower-privileged user who then submits database queries the application fails to scope to their privilege level, returning system-wide inventory (devices, substations, users, scheduled activities). Limiting factors: valid credentials are mandatory, impact is read-only confidentiality disclosure of configuration/topology metadata with no integrity or availability effect, and all deployed versions below V6.0 are affected (upgrade to V6.0 is the remediation boundary).

This is a moderate-severity information-disclosure flaw (CVSS 4.3) whose signals consistently point to low real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network reachability with low attack complexity, but critically requires existing low-level authentication (PR:L) and yields only limited confidentiality impact with no integrity or availability effect - consistent with CWE-201 (information exposure) and the description's account of a privilege-boundary bypass on database queries. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. SSVC-style reasoning: exploitation status is 'none' (no public exploit identified), technical impact is partial (read-only disclosure), and automatability is questionable since an authenticated session is required. The signals do not conflict - a genuinely authenticated, confidentiality-only issue - so this reads as a legitimate but lower-tier hardening fix best handled on a normal patch cycle, with elevated attention only for high-assurance substation environments where the disclosed topology data (devices, substations, users, schedules) has reconnaissance value.

An attacker who already holds a valid but low-privilege RUGGEDCOM CROSSBOW account issues database queries that the application fails to restrict to their authorization level, returning system-wide records. This lets them enumerate all managed devices, substations, user accounts, and scheduled activities for reconnaissance, even though their role should not expose that data. No public exploit code was identified at time of analysis, and the attack requires network access plus valid credentials.