attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Siemens RUGGEDCOM CROSSBOW
Classified as
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Siemens
RUGGEDCOM CROSSBOW
Subsystems
General OT
Sectors
Multiple
What to Know
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. (NVD)
What to Do
Monitor Siemens's web page for any future patch releases.