Siemens RUGGEDCOM CROSSBOW
Plan PatchCVSS 8.8ICS-CERT ICSA-26-295-12Oct 13, 2026
Siemens
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version.
What this means
What could happen
Could allow an attacker to read or modify database contents
Who's at risk
Organizations in critical infrastructure using Siemens equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device with basic access credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited - EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule - requires maintenance window
0/1Patching may require device reboot, plan for process interruption
UPGRADEUpdate to V6.0 or later version
CVEs (11)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/91b09ff2-67ef-4c61-9d4e-9094ca04a008Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.