Siemens RUGGEDCOM CROSSBOW Multiple Vulnerabilities Allow SQL Injection and Privilege Escalation

Siemens RUGGEDCOM CROSSBOW, an industrial communication and routing platform used in critical infrastructure sectors, was found to contain multiple vulnerabilities disclosed on 2026-10-22. The affected versions are those prior to V6.0. Eleven CVEs were assigned: CVE-2026-89196 through CVE-2026-89206.

The vulnerabilities stem from improper neutralization of special elements used in SQL commands (SQL injection), authorization bypass through user-controlled key insertion, insertion of sensitive information into sent data, and client-side enforcement of server-side security. Successful exploitation could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials for various internal systems, escalate privileges, modify system configurations, and cause a denial of service.

The impacted critical infrastructure sectors include Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities. The vendor headquarters is located in Germany. The CVSS v3.1 base scores for the SQL injection vectors are 8.8, classified as HIGH.

Siemens has released a new version, RUGGEDCOM CROSSBOW V6.0, and strongly recommends that all users update to the latest version to remediate the vulnerabilities. No public exploit code was confirmed in the advisory, but the privilege‑authenticated nature of the flaws increases risk for deployed environments.