Security Advisory

CVE-2026-89198: Siemens RUGGEDCOM CROSSBOW Firmware-Filename SQL Injection (pending)

Last updated:
  • CVE-2026-89198
Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-89198 is a SQL injection flaw in how Siemens RUGGEDCOM CROSSBOW handles firmware-file uploads: an authenticated attacker with specific privileges can run arbitrary SQL commands on the underlying database by uploading a firmware file with a crafted filename, and Siemens has already shipped a fix in V6.0, but NVD has not yet completed its own CVSS scoring or CPE analysis, so this page stays noindex until that analysis is published.

Vulnerability summary

N/A

Not yet scored

0.3%

EPSS score (FIRST)

No

CISA KEV catalog

2026-10-13

Published

Vulnerability ID: CVE-2026-89198 · Source: NVD

Affected components

ComponentCPEVersion range
Siemens RUGGEDCOM CROSSBOW—All versions prior to V6.0 (fixed in V6.0); one of 11 related CVEs disclosed together in SSA-508506

What this means

CVE-2026-89198 (CWE-89, SQL injection) is one of 11 related vulnerabilities (CVE-2026-89196 through CVE-2026-89206) that Siemens disclosed together in advisory SSA-508506 for RUGGEDCOM CROSSBOW. For this specific CVE, NVD's description (matching the Siemens text) states: "Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database" (NVD) — notably, this is the firmware-upload path specifically, distinct from the facility-name (CVE-2026-89196) and notification-condition (CVE-2026-89197) injection points disclosed in the same advisory.

Siemens scores CVE-2026-89198 at CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 8.7 (high) — the same score given to the other SQL-injection CVEs in this batch, since all share the same access and impact profile. NVD's own status for this CVE is "Awaiting Analysis" as of 2026-10-26: NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score and cpe unset rather than presenting the Siemens-submitted figure as NVD-confirmed (Siemens Security Advisory SSA-508506; NVD).

A fix already exists for all 11 CVEs in this advisory: Siemens recommends updating RUGGEDCOM CROSSBOW to V6.0 or later, available through the Siemens Industry Online Support portal; no interim workaround is given beyond standard network-isolation guidance (Siemens Security Advisory SSA-508506). CISA republished the same advisory as ICSA-26-295-12, recommending organizations minimize control-system network exposure, isolate these systems behind firewalls, and use VPNs for any required remote access (CISA ICS Advisory ICSA-26-295-12).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00304 (22.951th percentile) — consistent with a flaw that requires authentication and specific privileges rather than being remotely, unauthenticatedly exploitable (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing even though a vendor fix is already available. Operators of RUGGEDCOM CROSSBOW below V6.0 should update now and restrict firmware-upload privileges to trusted administrators in the meantime.

How to fix this class of issueThis advisory's weakness class is SQL injection. Our practical guide covers how to detect, fix, verify and disclose it: How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware.

Evidence

  • Unsanitized firmware-upload filename handling in RUGGEDCOM CROSSBOW lets an authenticated attacker with specific privileges run arbitrary SQL commands on the underlying database (CWE-89). — Siemens Security Advisory SSA-508506
  • Siemens scores this CVE at CVSS v3.1 8.8 (high) / v4.0 8.7 (high); NVD status is "Awaiting Analysis" with no NVD-published score or CPE configuration as of 2026-10-26. — NVD
  • One of 11 related CVEs (CVE-2026-89196 through CVE-2026-89206) disclosed in SSA-508506; all affect RUGGEDCOM CROSSBOW versions before V6.0; a fix is available in V6.0. — CISA ICS Advisory ICSA-26-295-12
  • Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
  • EPSS score is 0.00304 (22.951th percentile) as of 2026-10-26. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2026-89200: Siemens RUGGEDCOM CROSSBOW File-Label SQL Injection (pending)CVE-2026-89200: RUGGEDCOM CROSSBOW fails to validate the Name and Value fields used for custom file labels, letting an authenticated administrator run arbitrary SQL commands against the underlying database. NVD has not yet scored it (Awaiting Analysis) and it is not on CISA KEV, so this page is pending.CVE-2026-89201: Siemens RUGGEDCOM CROSSBOW SQL Injection (pending)CVE-2026-89201: unsanitized device group/facility names in RUGGEDCOM CROSSBOW's Bulk Export workflow let an authenticated attacker run arbitrary SQL. NVD analysis incomplete, noindex pending review.CVE-2026-9082: Drupal Core SQL Injection (KEV)CISA KEVCVE-2026-9082: KEV SQL injection in Drupal core's database abstraction API, anonymously exploitable on PostgreSQL-backed sites. Versions, fix, scoring sourced to NVD, Drupal and CISA KEV.

Sources

  1. Siemens Security Advisory SSA-508506
  2. NVD
  3. CISA ICS Advisory ICSA-26-295-12
  4. CISA KEV
  5. FIRST EPSS