CVE-2023-27310
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
In RUGGEDCOM CROSSBOW (All versions < V5.2), the client query handler fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.
Risk Assessment
This could lead to privilege escalation and administrative takeover of the system by an unauthorized user.
Recommendation
Update RUGGEDCOM CROSSBOW to version V5.2 or later.
Other vulnerabilities in RUGGEDCOM CROSSBOW
See all- CVE-2023-37372Critical
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4) that is vulnerable to SQL injection. This could allow unauthenticated remote attackers to execute arbitrary SQL queries on the server database.
- CVE-2026-89206Medium
In RUGGEDCOM CROSSBOW (All versions < V6.0), affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.
- CVE-2026-89205Medium
In RUGGEDCOM CROSSBOW (All versions < V6.0), affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.
- CVE-2026-89204Medium
A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves improper restriction of access to database queries used for subnet management. An authenticated attacker could read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.
- CVE-2026-89203Medium
A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to improper restriction of access to various database queries, allowing users to retrieve system-wide information not intended for their privilege level. An authenticated attacker could gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.
- CVE-2026-89202Medium
A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves missing proper authorization checks for device disconnection requests. An authenticated attacker with minimal privileges could disconnect active sessions of other users, including administrators, leading to a denial of service.
- CVE-2026-89201High
In RUGGEDCOM CROSSBOW (all versions before V6.0), affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
- CVE-2026-89200Medium
A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to lack of input validation and sanitization in the Name and Value fields for custom file labels. An authenticated attacker with administrative privileges could execute arbitrary SQL commands on the underlying database.
- CVE-2026-89199High
A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) allows unauthorized access to sensitive configuration items via specific database queries. An authenticated attacker can retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.
- CVE-2026-89198High
A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves lack of validation and sanitization of firmware filenames during upload. An authenticated attacker with specific privileges can execute arbitrary SQL commands on the underlying database.
Original NVD description (English source)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS