CVE-2026-89203

EUVD-2026-98401

13.10.2026, 10:17

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
siemens	CNA	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 20.56%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
siemens	ruggedcom_crossbow	𝑥 < 6.0	CNA

Common Weakness Enumeration

CWE-201 - Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References

https://cert-portal.siemens.com/productcert/html/ssa-508506.html