A flaw in the subnet management module of Siemens RUGGEDCOM CROSSBOW fails to enforce proper authorization controls when executing database queries. The weakness allows an attacker who has already authenticated to the device to read, modify, or delete subnet configuration information, potentially exposing sensitive network topologies and compromising network integrity. This is a classic example of authorization bypass through privileged accounts, as identified by CWE-639.

Siemens RUGGEDCOM CROSSBOW devices running any firmware version earlier than V6.0 are susceptible to this vulnerability. All affected deployments that expose the subnet management interface to authenticated users are at risk.

The CVSS score of 5.3 indicates a moderate overall risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread known exploitation to date. The flaw requires the attacker to have valid credentials, so typical exploitation would occur from an authenticated remote or local session with elevated privileges.