CVE-2023-27463

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en RUGGEDCOM CROSSBOW (Todas las versiones anteriores a V5.3). El formulario de registro de auditoría de las aplicaciones afectadas es vulnerable a inyección SQL. Esto podría permitir a atacantes remotos autenticados ejecutar consultas SQL arbitrarias en la base de datos del servidor.

Information

Published : 2023-03-14 10:15

Updated : 2026-10-23 23:10

NVD link : CVE-2023-27463

Mitre link : CVE-2023-27463

CVE.ORG link : CVE-2023-27463

JSON object : View

Products Affected

siemens

ruggedcom_crossbow

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-27463", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-27463", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T18:59:15.597009Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "RUGGEDCOM CROSSBOW", "versions": [{"status": "affected", "version": "All versions < V5.3"}], "defaultStatus": "unknown"}]}], "published": "2023-03-14T10:15:29.757", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en RUGGEDCOM CROSSBOW (Todas las versiones anteriores a V5.3). El formulario de registro de auditor\u00eda de las aplicaciones afectadas es vulnerable a inyecci\u00f3n SQL. Esto podr\u00eda permitir a atacantes remotos autenticados ejecutar consultas SQL arbitrarias en la base de datos del servidor."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2CBB4F0-C72F-4816-94A2-782AFEEE8AD8", "versionEndExcluding": "5.3"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}