CVE-2026-89200
6.7MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Authenticated local administrators can execute arbitrary SQL commands on the underlying database. To exploit this, an attacker must already have local access and administrative privileges on the target system.
Root cause
The application fails to validate or sanitize input in the Name and Value fields for custom file labels, causing an SQL injection flaw.
Affected systems
RUGGEDCOM CROSSBOW all versions < V6.0
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade RUGGEDCOM CROSSBOW to version V6.0 or higher. If patching must wait, restrict administrative access to trusted personnel and avoid creating custom file labels with untrusted input.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.