Vulnerability in Siemens RUGGEDCOM CROSSBOW

[ Description ]Official description

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL13 Oct 2026NCSC-2026-0415

  Vulnerabilities fixed in Siemens products Translated from Dutch

  Probability/damage M/HCVE-2024-7322CVE-2025-6965CVE-2025-70873+38 more CVEs

[ References ]References

• cert-portal.siemens.com/productcert/html/ssa-508506.html