CVE-2026-89205: Siemens RUGGEDCOM CROSSBOW authorization bypass and SQL injection

CVE-2026-89205 · Severity: medium · CVSS 6.3 · Published 2026-10-13

RUGGEDCOM CROSSBOW is a secure access management solution used to provide controlled access to industrial network devices in compliance with regulatory standards. Versions prior to V6.0 contain multiple vulnerabilities including authorization bypasses and SQL injection flaws that allow authenticated attackers to escalate privileges, retrieve administrative credentials, execute unauthorized operations, and potentially cause service disruptions. An attacker with minimal privileges could compromise the entire system's confidentiality, integrity, and availability.

Technologies: Siemens RUGGEDCOM CROSSBOW. Vendors: Siemens.

Quick answers

Is CVE-2026-89205 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89205 being exploited in the wild.
How severe is CVE-2026-89205?
Medium severity, with a CVSS score of 6.3, published 13 October 2026.
Which products and versions are affected?
Siemens RUGGEDCOM CROSSBOW All versions < V6.0.
Is there a fix for CVE-2026-89205?
Yes: fixed in V6.0 or later. Until then: Siemens recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens operational guidelines for Industrial Security to minimize exposure. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89205 attacked?
It is attacked over the network.
Am I affected by CVE-2026-89205?
Check whether you run Siemens RUGGEDCOM CROSSBOW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: V6.0 or later

Siemens recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens operational guidelines for Industrial Security to minimize exposure.

Technical details

The product fails to properly validate and sanitize user input in multiple areas including facility names (bulk import/export), notification conditions, firmware upload filenames, and custom file labels—leading to SQL injection attacks (CWE-89). Additionally, inadequate authorization checks on database queries and device operations allow authenticated attackers to bypass access controls and retrieve sensitive credentials (CWE-639). Network and local attack vectors are possible with low complexity; the vulnerabilities require authentication but not elevated privileges in most cases.

Affected products

  • Siemens RUGGEDCOM CROSSBOW All versions < V6.0

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.