Siemens RUGGEDCOM CROSSBOW: SQL injection via custom file label fields
Summary
RUGGEDCOM CROSSBOW versions below V6.0 do not properly validate or sanitize the Name and Value fields for custom file labels. An authenticated attacker with administrative privileges can execute arbitrary SQL commands on the underlying database. The CVSS v4.0 base score of 8.4 assumes local access, but the scores reported by different sources vary, and the Siemens advisory lists 8.7 for the whole advisory.
Affected
- Siemens RUGGEDCOM CROSSBOW, all versions below V6.0
Fixed in
- Update to RUGGEDCOM CROSSBOW V6.0 or later (Siemens advisory SSA-508506).
Workaround
- Unknown. No CVE-specific workaround is documented; the only listed remediation is the update to V6.0.
- Until patched, restrict administrator accounts and limit network access to the CROSSBOW system.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild found at the time of research.
- No public proof of concept found. EPSS is 0.00184 (very low).
Our recommendation
- Check whether CROSSBOW is used in your environment, especially in energy or utility operations.
- Update to V6.0 or later as part of the full CROSSBOW update batch from Siemens (CVE-2026-89196 to CVE-2026-89206).
- Restrict administrator accounts and keep the management interface away from the internet and untrusted networks.
- Monitor for unusual database activity and administrative logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Siemens SSA-508506 security advisory cert-portal.siemens.com
- CISA ICS advisory ICSA-26-295-12 www.cisa.gov
- CVE record mirror (threatint) cve.threatint.com
- ISSSource: Siemens clears RUGGEDCOM CROSSBOW issues www.isssource.com
- Vulners CVE-2026-89200 vulners.com
- VulDB entry 417537 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:35.
Original description (NVD)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.