This vulnerability in Siemens RUGGEDCOM CROSSBOW allows an attacker with appropriate credentials to input unsanitized data in the Value field of notification conditions. The flaw leads to arbitrary SQL execution against the internal database, potentially exposing sensitive configuration data or allowing further compromise. The weakness aligns with CWE-89 and is rated with a CVSS score of 8.7.

All versions of RUGGEDCOM CROSSBOW older than 6.0 are affected. The vulnerability impacts the device firmware used in industrial control environments and other applications relying on the notification profile feature. Siemens is the vendor, and the product is RUGGEDCOM CROSSBOW.

The flaw was assessed with a high severity score of 8.7. Exploit probability data is unavailable, and the issue is not currently listed in the CISA KEV catalog. The description indicates that an attacker must be authenticated and possess certain privileges to modify notification profiles, suggesting that the attack vector requires compromised credentials rather than public exposure. Due to the lack of additional exploitation statistics, administrators should consider the high CVSS as a strong indication of urgency for patching.