{"id":"CVE-2026-89197","published":"2026-10-13T10:17:21.060","lastModified":"2026-10-16T18:19:42.710","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-508506.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability exists in RUGGEDCOM CROSSBOW devices where unvalidated input in notification condition values allows authenticated attackers to execute arbitrary SQL commands on the underlying database. This could lead to full database compromise and potential system access.","exploitability":"Exploitation requires an authenticated user with specific privileges to configure notification profiles, making it moderately difficult but not highly complex to achieve.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive operational data, modify critical configurations, and potentially escalate privileges within the industrial control system environment.","remediation":"Upgrade to firmware version 6.0 or later to address this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","ics","database","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:03:31.707Z"}}