Siemens RUGGEDCOM CROSSBOW Station Access Controller Vulnerabilities Disclosed

Siemens has released security advisory information regarding multiple vulnerabilities affecting the RUGGEDCOM CROSSBOW Station Access Controller (SAC). The identified flaws reside in the integrated SQLite component and impact SAC versions with a version number less than 6.0.

The vulnerabilities include:
- CVE-2025-6965: A numeric truncation error in SQLite versions before 3.50.2 that could lead to memory corruption.
- CVE-2025-70873: An information disclosure issue in the zipfileInflate function allowing attackers to obtain heap memory via a crafted ZIP file. This affects SQLite v3.51.1 and earlier.
- CVE-2025-71316: A critical vulnerability (CVSS 9.8) involving improper handling of Unicode encoding in SQLite's sqldiff.exe. Exploitation could allow an attacker to load an arbitrary DLL via crafted command line arguments, resulting in command line file arguments being misinterpreted.
- CVE-2026-11822: Memory corruption vulnerabilities in the FTS5 full-text search extension in SQLite before 3.53.2. These could allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution via a crafted database with malformed FTS5 page data.
- CVE-2026-11824: Additional memory corruption vulnerability in the same FTS5 extension.

Siemens states that successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. The affected sectors span Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities. The vulnerabilities are present worldwide.

Siemens recommends updating to version V6.0 or later of the RUGGEDCOM CROSSBOW Station Access Controller (SAC) as the primary mitigation. For the underlying SQLite component, upgrading to SQLite version 3.50.2 or above, 3.51.1 or above, or 3.53.2 or above is advised depending on the specific CVE.