Description
A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level.
Published: 2026-04-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Vendor Update
AI Analysis

Impact

The flaw permits a User Administrator with valid credentials to alter group memberships for any device group, effectively granting themselves full access to devices at any authorization level. This improper authorization defect enables an authenticated internal user to elevate privileges beyond what their role permits, potentially exposing confidential device data and control interfaces.

Affected Systems

Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM‑P) is affected; all releases older than version 5.8 contain the vulnerability.

Risk and Exploitability

The CVSS base score of 8.7 classifies this as a high‑severity vulnerability. No EPSS data is available and the flaw is not listed in the CISA KEV catalog. Attackers must possess a User Administrator account; once authenticated, exploitation is straightforward and requires no additional steps beyond modifying group assignments.

Generated by OpenCVE AI on April 14, 2026 at 10:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all SAM‑P installations to version 5.8 or later, or apply any vendor‑supplied patch addressing this issue.
  • Limit the number of User Administrator accounts and enforce least‑privilege policies to reduce the risk of accidental or malicious misuse.
  • Configure audit logging for group membership changes and regularly review logs to detect unauthorized modifications.

Generated by OpenCVE AI on April 14, 2026 at 10:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Improper Group Administration in Siemens RUGGEDCOM Secure Access Manager

Tue, 14 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Siemens
Siemens ruggedcom Crossbow Secure Access Manager Primary (sam-p)
Vendors & Products Siemens
Siemens ruggedcom Crossbow Secure Access Manager Primary (sam-p)

Tue, 14 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level.
Weaknesses CWE-266
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Siemens Ruggedcom Crossbow Secure Access Manager Primary (sam-p)
cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2026-04-14T12:58:05.664Z

Reserved: 2026-02-23T10:07:00.531Z

Link: CVE-2026-27668

cve-icon Vulnrichment

Updated: 2026-04-14T12:58:01.734Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-14T09:16:35.480

Modified: 2026-04-17T15:18:16.507

Link: CVE-2026-27668

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-14T16:30:38Z

Weaknesses