CVE-2026-89204
5.4MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated network attackers can view, alter, or delete subnet configurations. They need valid user credentials on the RUGGEDCOM CROSSBOW instance to exploit it.
Root cause
The application fails to restrict access to database queries handling subnet management, allowing authorization bypass via direct object references.
Affected systems
RUGGEDCOM CROSSBOW all versions < V6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade RUGGEDCOM CROSSBOW to version V6.0 or later. If updating immediately is not possible, restrict network access to the CROSSBOW management interface to trusted hosts only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.