CVE-2026-110935

Name of the Vulnerable Software and Affected Versions Siemens RUGGEDCOM CROSSBOW (affected versions not specified)

Description The PFI plugin framework deployment routine fails to validate path components during the extraction of archive entries to the local plugin repository. Because archive entries containing relative path segments like .. are not rejected, an unauthenticated local attacker can write files to arbitrary locations outside the plugin repository that are accessible with the current user's permissions. This could lead to full system compromise, the bypassing of Purdue Level 2 zoning, and the hijacking of substation protective relays.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.