CVE-2026-89203
4.3MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-201
Impact
Authenticated low-privilege attackers can extract sensitive system-wide infrastructure data, including details on all connected devices, substations, users, and scheduled activities. They only need standard network access and valid low-privilege credentials on the system.
Root cause
The application fails to properly restrict access to internal database queries based on the user's privilege level.
Affected systems
RUGGEDCOM CROSSBOW versions prior to V6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade RUGGEDCOM CROSSBOW to version V6.0 or later. If upgrading immediately is not possible, restrict network and login access to trusted administrators only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.