Full Report
RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Flaws in RUGGEDCOM CROSSBOW (SQLi and Privilege Escalation)
## CVE Details
- **CVE IDs:**
- **SQL Injection:** CVE-2026-89196, CVE-2026-89197, CVE-2026-89198
- **Information Disclosure:** CVE-2026-89203, CVE-2026-89199
- **Authorization Bypass/Logic Flaws:** CVE-2026-89204, CVE-2026-89205, CVE-2026-89206
- **CVSS Score:**
- CVSS v3.1: **8.8 (High)**
- CVSS v4.0: **8.7 (High)**
- **CWE:** CWE-89 (SQL Injection), CWE-201 (Information Exposure), CWE-639 (Insecure Direct Object Reference), CWE-602 (Client-Side Enforcement of Server-Side Security).
## Affected Systems
- **Products:** RUGGEDCOM CROSSBOW (Secure Access Management solution).
- **Versions:** All versions prior to V6.0.
- **Configurations:** The vulnerabilities primarily impact the management server components, specifically involving Bulk Import/Export, Notification Profile configurations, and Scheduled Activity workflows.
## Vulnerability Description
RUGGEDCOM CROSSBOW is susceptible to multiple security flaws stemming from improper input validation and insufficient server-side authorization:
1. **SQL Injection:** Lack of sanitization in facility names (Bulk Import), notification condition values, and firmware filenames allow authenticated users to execute arbitrary commands on the backend database.
2. **Information Exposure:** The system inadvertently leaks sensitive configuration data and scheduled activity details to unauthorized users.
3. **Broken Access Control:** Failures in server-side authorization allow low-privileged attackers to bypass client-side restrictions to read/modify subnets or manipulate (retry, stop, delete) scheduled tasks without appropriate permissions.
## Exploitation
- **Status:** Not exploited (No reports of active exploitation in the wild provided).
- **Complexity:** Low (Requires valid, though potentially low-level, authenticated access).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Access to administrative credentials and sensitive database records).
- **Integrity:** High (Ability to modify system configurations, subnets, and scheduled tasks).
- **Availability:** High (Potential for Denial of Service via unauthorized task deletion or database manipulation).
## Remediation
### Patches
- **Update to RUGGEDCOM CROSSBOW V6.0** or a later version.
- Download available at: hxxps://support[.]industry[.]siemens[.]com/cs/ww/en/view/110006651/
### Workarounds
- Protect network access to RUGGEDCOM devices with robust firewalls and segmentation.
- Follow Siemens' operational guidelines for Industrial Security to ensure the device is operated in a protected IT environment.
- Limit user permissions to the absolute minimum required for their roles to reduce the attack surface for low-privilege exploits.
## Detection
- **Indicators of Compromise:** Monitor database logs for unusual SQL syntax or unauthorized queries originating from the CROSSBOW application service account.
- **Detection methods:** Audit system logs for unexpected modifications to subnet configurations or unauthorized changes to the state of scheduled activities. Review Bulk Import and firmware upload history for suspicious filenames containing special SQL characters (e.g., `'`, `;`, `--`).
## References
- **Siemens Security Advisory:** hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-508506[.]html
- **Industrial Security Guidelines:** hxxps://www[.]siemens[.]com/cert/operational-guidelines-industrial-security