CVE-2026-89202
6.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-639
Impact
Authenticated low-privilege attackers can disconnect active user and administrator sessions to cause a denial of service. They only need standard network access and minimal account privileges.
Root cause
The application fails to perform proper authorization checks when handling device disconnection requests.
Affected systems
RUGGEDCOM CROSSBOW all versions < V6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade RUGGEDCOM CROSSBOW to version V6.0 or later. If upgrading immediately is not possible, restrict network access and account privileges to trusted personnel only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.