noindex and left out of the sitemap until more data is confirmed.CVE-2026-89204 is a missing-authorization flaw in Siemens RUGGEDCOM CROSSBOW, all versions before V6.0: the database queries used for subnet management do not check that the requesting user is authorized to see or change that data, so an authenticated attacker can read, modify or delete subnet configurations. It is not on CISA's KEV list and NVD still shows it as "Awaiting Analysis" as of 2026-10-28, so this page is pending and the 5.4/5.3 figures below are Siemens' own CNA submission, not an NVD-confirmed score.
Vulnerability summary
N/A
Not yet scored
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-89204 · Source: Siemens (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW | cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:* | all versions < V6.0 (fixed in V6.0) |
What this means
CVE-2026-89204 is a Missing Authorization vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) in Siemens RUGGEDCOM CROSSBOW, a station-management and engineering tool for RUGGEDCOM substation automation networks. NVD's description, sourced from the Siemens CNA, states: "Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation" (NVD).
Siemens' own PSIRT advisory SSA-508506 lists the score it submitted: CVSS v3.1 5.4 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, and CVSS v4.0 5.3 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (Siemens PSIRT Advisory SSA-508506). NVD's own vulnerability-status field still reads "Awaiting Analysis" as of 2026-10-28, so NVD has not published an independent score, and the CVE is not on the CISA KEV catalog. Per our indexing policy, this page therefore stays noindex with no NVD-confirmed cvss_score; the figures above are Siemens' own submission, not NVD's.
SSA-508506 is the same bundle advisory covering eleven CROSSBOW CVEs in total (CVE-2026-89196 through CVE-2026-89206), spanning SQL injection, authorization-bypass and sensitive-data-exposure issues across the product's web and database layers; CVE-2026-89204 is one of four lower-severity authorization-bypass issues in that bundle (alongside CVE-2026-89203, CVE-2026-89205 and CVE-2026-89206) that require only low privileges (PR:L) rather than the administrative access the SQL-injection CVEs in the same advisory require (Siemens PSIRT Advisory SSA-508506). CISA republished the same advisory as ICSA-26-295-12 on 2026-10-22 (CISA ICS Advisory ICSA-26-295-12). The documented fix for all eleven CVEs is to update RUGGEDCOM CROSSBOW to V6.0 or later; Siemens does not list an interim workaround beyond its general guidance to restrict network access to trusted operators and use firewalls/VPNs for any remote administration.
Exploitation requires only a low-privilege authenticated session (PR:L) rather than full administrative access, but neither Siemens nor CISA report observed in-the-wild exploitation. As of 2026-10-28, FIRST scores the probability of exploitation at 0.00142 (3.53th percentile), consistent with an authenticated, substation-network-only flaw with no known active exploitation (FIRST EPSS).
Until NVD completes analysis, treat the 5.4/5.3 figures as indicative only. Sites running RUGGEDCOM CROSSBOW before V6.0 should update and, in the meantime, limit which operators hold accounts that can reach the subnet-management functions.
Evidence
- RUGGEDCOM CROSSBOW before V6.0 does not properly restrict access to database queries used for subnet management, letting an authenticated attacker read, modify or delete subnet configurations. — NVD
- CVSS v3.1 5.4 (MEDIUM) and v4.0 5.3 (MEDIUM), both submitted by the Siemens CNA; NVD vulnStatus is Awaiting Analysis as of 2026-10-28. — Siemens PSIRT Advisory SSA-508506
- SSA-508506 bundles eleven CROSSBOW CVEs (CVE-2026-89196 through CVE-2026-89206); CVE-2026-89204 is one of four low-privilege authorization-bypass issues in the bundle. Fix for all is update to V6.0 or later. — Siemens PSIRT Advisory SSA-508506
- CISA republished the Siemens advisory as ICSA-26-295-12 on 2026-10-22. — CISA ICS Advisory ICSA-26-295-12
- EPSS score is 0.00142 (3.53th percentile) as of 2026-10-28. — FIRST EPSS
