CVE-2026-89206
6.3MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-602
Impact
Authenticated low-privilege attackers with network access can tamper with scheduled tasks, including stopping, retrying, or deleting them without proper permissions.
Root cause
The application fails to perform server-side authorization checks when processing requests to modify scheduled action states.
Affected systems
RUGGEDCOM CROSSBOW all versions prior to V6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
Upgrade RUGGEDCOM CROSSBOW to version V6.0 or later; if patching must wait, restrict network access to the web interface and limit untrusted user accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.