securitytabs

CVE-2026-89203

Medium5.3

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.

CVSS
5.3v4.0
EPSS (exploit probability)
0.3%21th pct
CISA KEV
Not listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS held steady from 0.3% on 2026-10-14 to 0.3% on 2026-10-22, ranging 0.3%–0.3% across 9 daily scores.
2026-10-14 → 2026-10-22 · 9 days · 0.3%–0.3%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-220.3%21.0%
2026-10-210.3%20.9%
2026-10-200.3%20.8%
2026-10-190.3%20.8%
2026-10-180.3%20.7%
2026-10-170.3%20.7%
2026-10-160.3%20.7%
2026-10-150.3%20.6%
2026-10-140.3%20.6%

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Coverage1 article

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-22 20:34 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-22 20:34 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-22 20:34 UTC; score date 2026-10-22
  • KEV: CISA KEV, fetched 2026-10-22 20:34 UTC