Siemens RUGGEDCOM Devices Face Multiple Vulnerabilities

• •CROSSBOW devices are vulnerable to SQL injection and privilege escalation.
• •APE1808 devices face issues with improper authorization and lack of control.
• •Siemens recommends immediate updates and contacting support for affected devices.

Siemens has disclosed vulnerabilities in its RUGGEDCOM CROSSBOW and APE1808 devices, affecting critical infrastructure sectors worldwide. The RUGGEDCOM CROSSBOW is vulnerable to SQL injection attacks, allowing attackers to execute arbitrary SQL commands and escalate privileges (CVE-2026-89196 to CVE-2026-89206). The APE1808 devices are affected by various vulnerabilities, including improper authorization and lack of administrator control (CVE-2026-33387 to CVE-2026-33920). Siemens recommends updating to version 6.0 or later for CROSSBOW and contacting customer support for APE1808 patch information. The vulnerabilities impact sectors such as critical manufacturing, transportation, energy, healthcare, and government services. The CROSSBOW vulnerabilities were published on October 13, 2026, while APE1808 vulnerabilities were published on September 8, 2026.