CVE-2026-89200: Siemens RUGGEDCOM CROSSBOW File-Label SQL Injection (pending)

CVE-2026-89200 is a SQL injection flaw in Siemens RUGGEDCOM CROSSBOW, all versions before V6.0: the Name and Value fields used to define custom file labels are not properly validated, so an attacker who already holds administrative privileges can run arbitrary SQL commands against the underlying database, with high impact to confidentiality, integrity and availability. It is not on CISA's KEV list and NVD still shows it as "Awaiting Analysis" as of 2026-10-28, so this page is pending and the 6.7/8.4 figures below are Siemens' own CNA submission, not an NVD-confirmed score.

CVE-2026-89200 is a SQL injection vulnerability (CWE-89) in Siemens RUGGEDCOM CROSSBOW, a station-management and engineering tool for RUGGEDCOM substation automation networks. NVD's description, sourced from the Siemens CNA, states: "Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database" (NVD).

Siemens' own PSIRT advisory SSA-508506 lists the score it submitted: CVSS v3.1 6.7 (MEDIUM), vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 8.4 (HIGH), vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — the v4.0 figure scores noticeably higher because it drops the "changed scope" discount the v3.1 metric applies (Siemens PSIRT Advisory SSA-508506). NVD's own vulnerability-status field still reads "Awaiting Analysis" as of 2026-10-28, so NVD has not published an independent score, and the CVE is not on the CISA KEV catalog. Per our indexing policy, this page therefore stays noindex with no NVD-confirmed cvss_score; the figures above are Siemens' own submission, not NVD's.

SSA-508506 is a bundle advisory covering eleven CROSSBOW CVEs in total (CVE-2026-89196 through CVE-2026-89206), spanning SQL injection, authorization-bypass and sensitive-data-exposure issues across the product's web and database layers; CVE-2026-89200 is the only one of the eleven that requires local access (AV:L) rather than network access, because the vulnerable fields are reached through an administrative, already-authenticated session rather than directly over the network (Siemens PSIRT Advisory SSA-508506). CISA republished the same advisory as ICSA-26-295-12 on 2026-10-22 (CISA ICS Advisory ICSA-26-295-12). The documented fix for all eleven CVEs is to update RUGGEDCOM CROSSBOW to V6.0 or later; Siemens does not list an interim workaround beyond its general guidance to restrict network access to trusted operators and use firewalls/VPNs for any remote administration.

Exploitation already requires administrative privileges (PR:H), and neither Siemens nor CISA report observed in-the-wild exploitation. As of 2026-10-28, FIRST scores the probability of exploitation at 0.00142 (3.462th percentile), consistent with a privilege-gated, local database-injection flaw with no known active exploitation (FIRST EPSS).

Until NVD completes analysis, treat the 6.7/8.4 figures as indicative only. Sites running RUGGEDCOM CROSSBOW before V6.0 should update and, in the meantime, limit which operators hold the administrative role that can define custom file labels.

• RUGGEDCOM CROSSBOW before V6.0 does not validate the Name and Value fields for custom file labels, letting an authenticated administrative attacker run arbitrary SQL commands on the underlying database. — NVD
• CVSS v3.1 6.7 (MEDIUM) and v4.0 8.4 (HIGH), both submitted by the Siemens CNA; NVD vulnStatus is Awaiting Analysis as of 2026-10-28. — Siemens PSIRT Advisory SSA-508506
• SSA-508506 bundles eleven CROSSBOW CVEs (CVE-2026-89196 through CVE-2026-89206); fix for all is update to V6.0 or later. — Siemens PSIRT Advisory SSA-508506
• CISA republished the Siemens advisory as ICSA-26-295-12 on 2026-10-22. — CISA ICS Advisory ICSA-26-295-12
• EPSS score is 0.00142 (3.462th percentile) as of 2026-10-28. — FIRST EPSS