CVE-2026-89199

{
  "etk_id": "ETK-2026-1467",
  "cve_id": "CVE-2026-89199",
  "display_id": "CVE-2026-89199",
  "ghsa_id": "GHSA-cjf3-3mcw-2vg2",
  "euvd_id": "EUVD-2026-98397",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization in RUGGEDCOM CROSSBOW configuration queries",
  "summary": "RUGGEDCOM CROSSBOW versions before V6.0 may allow authenticated users to access protected configuration data outside their intended permissions. An attacker could obtain credentials for internal administrative systems and use them to disclose information or gain additional privileges.",
  "mitigation": "Upgrade RUGGEDCOM CROSSBOW to V6.0. Until upgrades are complete, limit authenticated access to trusted administrators and restrict network reachability to the management interface.",
  "vendor": "Siemens",
  "product": "RUGGEDCOM CROSSBOW",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < V6.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "V6.0"
      ],
      "package_name": "RUGGEDCOM CROSSBOW",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0034,
  "epss_percentile": 0.2649,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 26.943560366666667,
  "t0_at": "2026-10-13T09:19:03.033000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-14T13:59:44.628666+00:00",
      "days": 1.194925875763889,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T09:19:03.033000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T09:19:03.033000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T09:19:03.033000+00:00",
      "url": "https://github.com/advisories/GHSA-cjf3-3mcw-2vg2"
    }
  }
}