{"id":"CVE-2024-27940","aliases":["EUVD-2024-25114","GHSA-97qf-22x7-5h5h"],"status":"published","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected...","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00781,"percentile":0.5627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2024-05-14T10:02:08Z","modified":"2026-06-17T07:20:38Z","products":[{"vendor":"siemens","product":"ruggedcom crossbow"},{"vendor":"siemens","product":"ruggedcom_crossbow"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-916916.html","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27940"},{"url":"https://github.com/advisories/GHSA-97qf-22x7-5h5h"}],"sources":{"cve":[{"id":"CVE-2024-27940","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database.","status":"published","published":"2024-05-14T10:02:08.412Z","modified":"2024-08-02T00:41:55.962Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-25114","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database.","status":"published","published":"2024-05-14T10:02:08Z","modified":"2024-08-02T00:41:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-03T03:50:26.752963Z"}],"ghsa":[{"id":"GHSA-97qf-22x7-5h5h","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected...","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database.","status":"published","published":"2024-05-14T18:30:59Z","modified":"2024-05-14T18:31:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:57:21.290422Z"}],"nvd":[{"id":"CVE-2024-27940","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database.","status":"published","published":"2024-05-14T16:16:24.733Z","modified":"2026-06-17T07:20:38.397Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:09:58.124007Z"}]}}