A flaw in Siemens RUGGEDCOM CROSSBOW devices occurs when device group or facility names entered during the Bulk Export workflow are processed without proper validation or sanitization. The result is an authentication‑bound SQL injection vulnerability that allows an attacker, who has been granted certain privileged access, to run arbitrary SQL statements against the device’s underlying database. This could enable data theft, modification, or, if the injected statements raise privileges further, full compromise of the device’s control plane.

Affected devices are Siemens RUGGEDCOM CROSSBOW units running firmware versions earlier than 6.0. No other vendors or product lines are currently known to be impacted by this weakness.

The CVSS score of 7.7 classifies this flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which implies that publicly known exploits may not yet be observed. However, the attack requires authentication with specific privileges, meaning that users with the ability to initiate the Bulk Export workflow are at risk. An exploit could allow an attacker to alter or retrieve confidential data, and if the injected SQL payload includes commands that elevate privileges, full system takeover could be possible.