CVE-2026-89197
8.8 HIGHPublished 2026-10-13 · Updated 2026-10-16
AI risk analysis
- Summary
- A SQL injection vulnerability exists in RUGGEDCOM CROSSBOW devices where unvalidated input in notification condition values allows authenticated attackers to execute arbitrary SQL commands on the underlying database. This could lead to full database compromise and potential system access.
- Exploitability
- Exploitation requires an authenticated user with specific privileges to configure notification profiles, making it moderately difficult but not highly complex to achieve.
- Blast radius
- If exploited, this vulnerability could allow attackers to access sensitive operational data, modify critical configurations, and potentially escalate privileges within the industrial control system environment.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to firmware version 6.0 or later to address this SQL injection vulnerability.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-89196
- HIGHCVE-2015-20122
- HIGHCVE-2026-100644PoC
- HIGHCVE-2026-100683PoC
- HIGHCVE-2026-102796
- HIGHCVE-2026-103253PoC
- HIGHCVE-2026-105076
- CRITICALCVE-2026-105889
Related by shared AI tags and CWE weakness class. Browse the full archive.