The CVE-2026-89203 vulnerability was identified in Siemens RUGGEDCOM CROSSBOW devices. The product fails to properly restrict access to certain database queries, allowing an authenticated user with lower privileges to execute operations that return system-wide information that should be reserved for higher privilege levels. This can expose details about the infrastructure, such as all devices, substations, users, and scheduled activities, compromising confidentiality. The weakness aligns with CWE-201, which describes improper authorization of database operations.

Affected systems are Siemens RUGGEDCOM CROSSBOW devices running any firmware version earlier than V6.0. No later versions have been reported to contain the flaw, and Siemens indicates that the issue is fixed in V6.0 and above.

The CVSS score for this issue is 5.3, indicating a moderate impact. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting there is currently no widespread exploitation of this flaw. An attacker would need authenticated access, and the potential damage is limited to information disclosure rather than code execution or denial of service. The risk level can be considered moderate, and mitigation through patching or upgrading to a fixed version is strongly recommended.