# CVE-2026-89200: Siemens RUGGEDCOM CROSSBOW SQL injection in custom file labels

Source: https://junglewise.ai/threats/cve-2026-89200-a-vulnerability-has-been-identified-in-ruggedcom-crossbow-all  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-89200 · Severity: medium · CVSS 6.7 · Published 2026-10-13

Siemens RUGGEDCOM CROSSBOW is a secure access management system for industrial networks that provides NERC CIP-compliant access to network devices. An authenticated administrator can inject arbitrary SQL commands through custom file label fields, potentially exposing or modifying sensitive data in the underlying database, including administrative credentials and system configurations.

Technologies: [Siemens RUGGEDCOM CROSSBOW](https://junglewise.ai/threats/technologies/ruggedcom-crossbow). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-89200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89200 being exploited in the wild.

**How severe is CVE-2026-89200?** Medium severity, with a CVSS score of 6.7, published 13 October 2026.

**Which products and versions are affected?** Siemens RUGGEDCOM CROSSBOW All versions < V6.0.

**Is there a fix for CVE-2026-89200?** Yes: fixed in V6.0 or later. Until then: Restrict administrative access to the RUGGEDCOM CROSSBOW management interface using network segmentation and access controls as part of your Industrial Security configuration per Siemens operational guidelines. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89200 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-89200?** Check whether you run Siemens RUGGEDCOM CROSSBOW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in V6.0 or later

Restrict administrative access to the RUGGEDCOM CROSSBOW management interface using network segmentation and access controls as part of your Industrial Security configuration per Siemens operational guidelines.

## Technical details

The vulnerability is a SQL injection (CWE-89) in the Name and Value input fields for custom file labels. An authenticated attacker with administrative privileges can exploit improper input validation to execute arbitrary SQL commands against the underlying database. The attack requires local access and administrative-level authentication, allowing full compromise of database confidentiality, integrity, and availability.

## Affected products

- Siemens RUGGEDCOM CROSSBOW All versions < V6.0

## Timeline

- 2026-10-13: disclosed
- 2026-10-13: advisory: Siemens Security Advisory SSA-508506

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-508506.html](https://cert-portal.siemens.com/productcert/html/ssa-508506.html)

## Related threats

- [Siemens RUGGEDCOM CROSSBOW authorization bypass in scheduled actions](https://junglewise.ai/threats/cve-2026-89206-a-vulnerability-has-been-identified-in-ruggedcom-crossbow-all)
- [Siemens RUGGEDCOM CROSSBOW authorization bypass and SQL injection](https://junglewise.ai/threats/cve-2026-89205-a-vulnerability-has-been-identified-in-ruggedcom-crossbow-all)
- [Siemens RUGGEDCOM CROSSBOW SQL injection in database queries](https://junglewise.ai/threats/cve-2026-89204-a-vulnerability-has-been-identified-in-ruggedcom-crossbow-all)
- [Siemens RUGGEDCOM CROSSBOW privilege escalation and SQL injection](https://junglewise.ai/threats/cve-2026-89203-a-vulnerability-has-been-identified-in-ruggedcom-crossbow-all)
- [Siemens RUGGEDCOM CROSSBOW authorization bypass in session disconnection](https://junglewise.ai/threats/cve-2026-89202-a-vulnerability-has-been-identified-in-ruggedcom-crossbow-all)