Vulnerability in Siemens RUGGEDCOM CROSSBOW

[ Description ]Official description

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL13 Oct 2026NCSC-2026-0415

  Vulnerabilities fixed in Siemens products Translated from Dutch

  Probability/damage M/HCVE-2024-7322CVE-2025-6965CVE-2025-70873+38 more CVEs

[ References ]References

• cert-portal.siemens.com/productcert/html/ssa-508506.html