CVE-2026-89198

Siemens RUGGEDCOM CROSSBOW Multiple Vulnerabilities Allow SQL Injection and Privilege Escalation

Siemens RUGGEDCOM CROSSBOW industrial control software contains eleven identified vulnerabilities affecting versions prior to V6.0. The flaws include SQL injection, authorization bypass, sensitive information insertion, and client-side security enforcement issues. An authenticated attacker with specific privileges could execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, modify system configurations, and cause denial of service. Siemens has released version V6.0 and recommends all users update to the latest version to remediate the issues.