The vulnerability arises because RUGGEDCOM CROSSBOW does not enforce proper server‑side authorization for requests that change the state of scheduled actions. An attacker who can authenticate to the device, even with limited privileges, can issue commands to retry, stop or delete scheduled tasks. This ability undermines the integrity and availability of the device’s operational schedule and can disrupt mission‑critical workflows.

All Siemens RUGGEDCOM CROSSBOW deployments running a version earlier than V6.0 are affected.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and CISA does not list it in the KEV catalog, suggesting limited evidence of exploitation in the wild. However, the flaw can be exercised by a compromised authenticated session, so environments with exposed device interfaces or weak credential controls face higher risk. An attacker would need to first access the device and authenticate before exploiting the missing checks, after which they can manipulate scheduled operations.