A flaw in Siemens RUGGEDCOM CROSSBOW devices allows an authenticated attacker with minimal privileges to schedule special operations that normally require higher authorization. The vulnerability originates from missing server‑side authorization checks for scheduling requests, enabling unauthorized execution of privileged functions. Because the flaw requires an existing account, an attacker could potentially trigger critical or disruptive device functions and compromise system stability.

All RUGGEDCOM CROSSBOW firmware releases prior to V6.0 are affected. No specific firmware revisions are listed, so every earlier version should be assumed vulnerable.

The CVSS score of 5.3 places the vulnerability in the medium severity range. Exploitation requires valid credentials, which is a reasonable risk if weak or default passwords are present. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, indicating no publicly reported wide‑scale exploitation, but the lack of proper authorization checks means unsuitable operations can be performed once an account is accessed.