{"id":"CVE-2026-89200","aliases":["EUVD-2026-98398","GHSA-83r2-p444-6pj7"],"status":"published","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices...","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00142,"percentile":0.03511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-10-13T09:19:04Z","modified":"2026-10-15T20:38:04Z","products":[{"vendor":"siemens","product":"ruggedcom crossbow"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-508506.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89200"},{"url":"https://github.com/advisories/GHSA-83r2-p444-6pj7"}],"sources":{"cve":[{"id":"CVE-2026-89200","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.","status":"published","published":"2026-10-13T09:19:04.165Z","modified":"2026-10-13T10:56:50.972Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:55.526923Z"}],"euvd":[{"id":"EUVD-2026-98398","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.","status":"published","published":"2026-10-13T09:19:04Z","modified":"2026-10-13T10:56:50Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:21.215493Z"}],"ghsa":[{"id":"GHSA-83r2-p444-6pj7","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices...","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.","status":"published","published":"2026-10-13T12:32:58Z","modified":"2026-10-13T12:33:05Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:13:10.715475Z"}],"nvd":[{"id":"CVE-2026-89200","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.","status":"published","published":"2026-10-13T10:17:21.5Z","modified":"2026-10-15T20:38:04.303Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:56.72789Z"}]}}