Siemens Ruggedcom Crossbow vulnerabilities

CVE-2026-89206 [MEDIUM] CWE-602 CVE-2026-89206: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.

CVE-2024-27946 [MEDIUM] CWE-22 CVE-2024-27946: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). Downloading files o A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). Downloading files overwrites files with the same name in the installation directory of the affected systems. The filename for the target file can be specified, thus arbitrary files can be overwritten by an attacker with the required privileges.

CVE-2026-89200 [MEDIUM] CWE-89 CVE-2026-89200: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.

CVE-2026-89202 [MEDIUM] CWE-639 CVE-2026-89202: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.

CVE-2026-89204 [MEDIUM] CWE-639 CVE-2026-89204: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.

CVE-2024-27947 [MEDIUM] CWE-200 CVE-2024-27947: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected system A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems could allow log messages to be forwarded to a specific client under certain circumstances. An attacker could leverage this vulnerability to forward log messages to a specific compromised client.

CVE-2026-89203 [MEDIUM] CWE-201 CVE-2026-89203: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's

CVE-2023-27462 [MEDIUM] CWE-862 CVE-2023-27462: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query ha A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for.