Siemens RUGGEDCOM CROSSBOW devices have a flaw that allows authenticated users with minimal privileges to send disconnection requests for other users, including administrators. The device does not properly validate that the requester owns the session before terminating it, which results in a denial of service for the affected user. The vulnerability is rooted in an authorization bypass (CWE-639) and is limited to the local device session management function.

All RUGGEDCOM CROSSBOW variants released before firmware version 6.0 are affected. The issue does not extend to later firmware releases and applies to both on‑premises and edge deployments of the product.

The vulnerability carries a CVSS score of 7.1, classifying it as high severity. Exploitation requires the attacker to be authenticated, although only minimal privileges are sufficient to trigger the disconnection. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been confirmed. Nonetheless, any attacker who gains access to the device can interrupt critical sessions, particularly those of administrators, which may impact operational continuity.