Siemens RUGGEDCOM CROSSBOW
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Awaiting Analysis
Description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.
Weaknesses (CWE)
- CWE-639 — Authorization Bypass Through User-Controlled Key
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | siemens |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | siemens |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · productcert@siemens.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · productcert@siemens.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-98400
- GCVE · GCVE-0-2026-89202
Affected products
| Product | Versions |
|---|---|
| Siemens · RUGGEDCOM CROSSBOW | affected 0 < V6.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |