A flaw exists in Siemens RUGGEDCOM CROSSBOW firmware versions older than V6.0. The device does not properly validate or sanitize user input supplied in the Name and Value fields of custom file labels. As a result, an authenticated attacker with administrative privileges can inject arbitrary SQL statements into the underlying database. This allows the attacker to read, write, or delete data, compromising the confidentiality, integrity, and availability of the information stored on the device.

All Siemens RUGGEDCOM CROSSBOW units with firmware prior to version V6.0 are vulnerable. The issue arises from the custom file label feature present in these devices, so any installation or deployment of an older firmware revision bears the risk.

The Common Vulnerability Scoring System rates the flaw at 8.4, indicating a high severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrative authentication, but because such privileges may be granted over the network, an attacker who gains or is authorized for admin access can launch the exploit remotely. The vulnerability is therefore high risk within environments where administrative credentials are not tightly controlled.