CVE-2026-89202
Received Received - Intake

Unauthorized Session Disconnection in RUGGEDCOM CROSSBOW

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: siemens-SADP

Description
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89202
EUVD
EUVD-2026-98400

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Siemens RUGGEDCOM CROSSBOW 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Siemens RUGGEDCOM CROSSBOW devices running versions below V6.0. It allows an authenticated attacker with low privileges to disconnect active sessions of other users, including administrators, by exploiting improper authorization checks for device disconnection requests.

Detection Guidance

This vulnerability involves improper authorization checks in RUGGEDCOM CROSSBOW versions below V6.0, allowing session disconnections. Detection requires checking device firmware versions and monitoring for unauthorized session terminations. No specific commands are provided in the context.

Impact Analysis

An attacker could disrupt critical operations by disconnecting active sessions, leading to denial of service. This affects system availability and could impact industrial or operational environments relying on these devices.

Compliance Impact

This vulnerability could lead to unauthorized session disconnections, potentially disrupting critical operations. For GDPR, this may impact availability of services handling personal data, while for HIPAA, it could affect access to protected health information during active sessions.

Mitigation Strategies

Upgrade RUGGEDCOM CROSSBOW to version V6.0 or later to address the authorization check flaw. Ensure only trusted users have access to authenticated sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89202. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart