CVE-2026-89203 PUBLISHED

Assigner: siemens
Reserved: 11.09.2026 Published: 13.10.2026 Updated: 13.10.2026

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor Siemens
Product RUGGEDCOM CROSSBOW
Versions Default: unknown
  • affected from 0 to V6.0 (excl.)

References

Problem Types

  • CWE-201: Insertion of Sensitive Information Into Sent Data CWE