RUGGEDCOM CROSSBOW SAC before 6.0 includes vulnerable SQLite code
Original title: Siemens RUGGEDCOM CROSSBOW Station Access Controller
Five SQLite flaws can yield code execution, denial of service, or information disclosure; the product fix is V6.0 or later.
RUGGEDCOM CROSSBOW Station Access Controller versions before 6.0 include multiple vulnerabilities in the integrated SQLite component. Siemens says an attacker could execute arbitrary code, cause a denial of service, or obtain sensitive information. The issues include memory corruption, heap disclosure through a crafted ZIP file, a Unicode handling flaw in sqldiff.exe scored 9.8, and FTS5 heap overflows. Siemens recommends updating to V6.0 or later.
Unconfirmed: The advisory does not say whether the bundled SQLite builds include the affected sqldiff.exe or FTS5 paths.
- CVE-2025-6965 affects SQLite before 3.50.2 and is scored 7.7.
- CVE-2025-70873 discloses heap memory via a crafted ZIP file and is scored 7.5.
- CVE-2025-71316, involving sqldiff.exe and Unicode conversion, is scored 9.8.
- CVE-2026-11822 and CVE-2026-11824 are FTS5 flaws in SQLite before 3.53.2.
- The product is deployed worldwide, and Siemens is headquartered in Germany.
Impact: Arbitrary code execution, denial of service, or sensitive information disclosure
| Product | Affected | Fixed in |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) | < V6.0 | V6.0 or later |
- 1.Update RUGGEDCOM CROSSBOW Station Access Controller to V6.0 or later.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-6965 | Memory Corruption in SQLite < 3.50.2 Affecting Apple and Siemens Products | 7.2 | 76% | ||
| CVE-2025-70873 | An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory… | 7.5 | <1% | PoC | |
| CVE-2025-71316 | SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages | 9.2 | <1% | ||
CVE-2026-11822+1 related CVE | SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory… | 8.5 | <1% |
From the original article
6 min read at cisa.govView CSAF Summary RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.