Siemens RUGGEDCOM CROSSBOW Patches 11 Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Siemens patched 11 vulnerabilities in RUGGEDCOM CROSSBOW below V6.0 allowing authenticated SQL injection, credential theft, privilege escalation and DoS; update to V6.0.
Siemens released version 6.0 of RUGGEDCOM CROSSBOW, a device management platform used in rail, energy and other critical infrastructure networks, to address 11 vulnerabilities disclosed via Siemens ProductCERT (SSA-508506) and republished by CISA. The flaws stem from insufficient input sanitization in several workflows (Bulk Import/Export, Notification Profile configuration, firmware file uploads, custom file labels) that allow authenticated attackers with specific privileges to execute arbitrary SQL commands against the underlying database (CWE-89, several CVEs). Other issues involve missing server-side authorization checks (CWE-639, CWE-602) that let low-privileged authenticated users disconnect other users' sessions including administrators, schedule unauthorized device operations, modify or delete scheduled tasks, and access or manipulate subnet configuration data. One vulnerability (CVE-2026-89199) allows retrieval of administrative credentials for internal systems via unrestricted database queries, and another (CVE-2026-89203) exposes system-wide infrastructure information beyond a user's privilege level.
All 11 CVEs (CVE-2026-89196 through CVE-2026-89206) affect RUGGEDCOM CROSSBOW versions prior to V6.0, carry a CVSS v3 base score of 8.8, and require authenticated access to exploit — there is no indication of unauthenticated remote exploitation or in-the-wild activity. CISA notes this is a verbatim republication of the Siemens advisory with no evidence of active exploitation reported. Affected critical infrastructure sectors include Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services, with deployments worldwide.
Defenders should prioritize updating to RUGGEDCOM CROSSBOW V6.0 or later, the vendor's sole remediation path. Siemens and CISA additionally recommend standard ICS hardening: minimizing network exposure, isolating control system networks behind firewalls, and using VPNs for remote access while recognizing their own update requirements. No workarounds or mitigations beyond patching are listed for the individual vulnerabilities.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs