Siemens RUGGEDCOM CROSSBOW: SQL injection in Bulk Import/Export workflow

Summary

RUGGEDCOM CROSSBOW is a secure access management product for remote access to utility OT devices. Improper input validation of facility names in the Bulk Import/Export workflow allows an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. The CVSS 4.0 base score is 8.7 and the CVSS 3.1 base score is 8.8; the flaw is part of a batch of related vulnerabilities covered by the same Siemens advisory.

Affected

• RUGGEDCOM CROSSBOW, all versions < V6.0

Fixed in

• Update to RUGGEDCOM CROSSBOW V6.0 or later

Workaround

• Unknown. The vendor remedy is the update to V6.0 or later.

Exploitation

• No known exploitation in the wild; not confirmed in CISA KEV.
• No public exploit available according to VulDB.

Our recommendation

• Check whether RUGGEDCOM CROSSBOW is deployed, using an asset inventory.
• Update to V6.0 or later as a priority; one update covers the whole Siemens advisory batch.
• Until patched, restrict web access to a management network or jump host, limit accounts with bulk import/export privileges, and review database logs for unusual SQL syntax.
• If CROSSBOW is exposed to the internet, treat this as urgent.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Siemens ProductCERT SSA-508506 cert-portal.siemens.com
• CISA ICS advisory ICSA-26-295-12 www.cisa.gov
• VulDB entry 417534 vuldb.com
• Vulners CVE-2026-89196 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:34.