A vulnerability exists in Siemens RUGGEDCOM CROSSBOW that allows an authenticated attacker with certain privileges to supply malicious input for facility names during the Bulk Import/Export workflow. Because the application does not properly validate or sanitize this input, the attacker can inject SQL statements and execute arbitrary commands on the underlying database. This could result in data exfiltration, modification, or denial of service to the database layer. The weakness is an instance of SQL injection (CWE‑89).

Siemens RUGGEDCOM CROSSBOW devices running versions earlier than V6.0 are affected. Only devices that support the Bulk Import/Export workflow are at risk. No later versions are impacted.

The CVSS score of 8.7 indicates a high severity for this flaw. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the vulnerability can be exploited by any authenticated user with the specific privileges needed to use the Bulk Import/Export feature. Because the vulnerability requires authentication, attackers must have valid credentials and the right privileges, but once those conditions are met, arbitrary SQL execution is possible.