CVE-2026-89196

Summary

The vulnerability allows authenticated attackers to inject arbitrary SQL commands through unsanitized facility names during bulk import/export operations, potentially leading to full database compromise. This is particularly concerning because it enables attackers to execute malicious SQL queries on the underlying database without requiring additional privileges.

Exploitability

Exploitation requires an authenticated user with specific privileges to perform bulk import/export operations, making it moderately difficult but not highly complex to achieve.

Blast radius

If exploited, this vulnerability could allow attackers to access, modify, or delete sensitive operational data across all affected RUGGEDCOM CROSSBOW devices, potentially compromising the integrity and availability of critical infrastructure communications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version V6.0 or later to address this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.