CVE-2026-89198

{
  "etk_id": "ETK-2026-1468",
  "cve_id": "CVE-2026-89198",
  "display_id": "CVE-2026-89198",
  "ghsa_id": "GHSA-m4gx-65g7-f4vm",
  "euvd_id": "EUVD-2026-98396",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in RUGGEDCOM CROSSBOW firmware uploads",
  "summary": "RUGGEDCOM CROSSBOW releases before V6.0 are affected by SQL injection in firmware upload filename handling. An authenticated user with the necessary privileges could run SQL commands against the device database.",
  "mitigation": "Upgrade RUGGEDCOM CROSSBOW to V6.0. Until the upgrade is complete, limit firmware upload privileges to trusted administrators.",
  "vendor": "Siemens",
  "product": "RUGGEDCOM CROSSBOW",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < V6.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "V6.0"
      ],
      "package_name": "RUGGEDCOM CROSSBOW",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0042,
  "epss_percentile": 0.3498,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.605356366666667,
  "t0_at": "2026-10-13T09:19:01.894000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T09:19:01.894000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T09:19:01.894000+00:00",
      "url": "https://github.com/advisories/GHSA-m4gx-65g7-f4vm"
    }
  }
}