Siemens RUGGEDCOM CROSSBOW SAC Vulnerabilities Linked to SQLite Component
Multiple vulnerabilities in the SQLite component of Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) could allow attackers to execute arbitrary code, cause denial of service, or disclose sensitive information.
Siemens has issued a security advisory detailing several critical vulnerabilities affecting its RUGGEDCOM CROSSBOW Station Access Controller (SAC) devices. The flaws, identified in the integrated SQLite component, pose significant risks to industrial control systems across various critical infrastructure sectors.
Versions of the RUGGEDCOM CROSSBOW SAC prior to V6.0 are susceptible to these issues. The vulnerabilities stem from common weaknesses within the SQLite database engine, including numeric truncation, improper clearing of heap memory, flawed Unicode handling, and heap-based buffer overflows. These types of vulnerabilities can be exploited by attackers to gain unauthorized access, disrupt operations, or extract sensitive data.
Specifically, CVE-2025-6965 involves a numeric truncation error in SQLite versions before 3.50.2, potentially leading to memory corruption. CVE-2025-70873, an information disclosure vulnerability in the zipfile extension, could allow attackers to obtain heap memory by supplying a crafted ZIP file. Another critical flaw, CVE-2025-71316, relates to improper handling of Unicode encoding by the sqldiff.exe utility, which could be leveraged to load arbitrary DLLs.
Further compounding the risk are vulnerabilities CVE-2026-11822 and CVE-2026-11824, both affecting the FTS5 full-text search extension in SQLite versions prior to 3.53.2. These flaws include memory corruption, out-of-bounds reads, and heap-based buffer overflows, which could result in process crashes, memory exhaustion, or arbitrary code execution when an FTS5 MATCH query is executed against a malicious database.
The potential impact of these vulnerabilities is severe, with CVSS scores reaching as high as 9.8 (CRITICAL). Exploitation could lead to attackers executing arbitrary code, causing denial of service, or obtaining sensitive information. Given the deployment of RUGGEDCOM devices in critical sectors such as manufacturing, transportation, energy, and healthcare, successful exploitation could have far-reaching consequences for essential services.
Siemens has addressed these vulnerabilities by releasing version V6.0 of the RUGGEDCOM CROSSBOW Station Access Controller (SAC). The company strongly recommends that all users update to this latest version to mitigate the identified risks. Organizations operating these devices should prioritize the update to ensure the security and integrity of their industrial control systems.
The affected product is deployed worldwide, with Siemens' headquarters located in Germany. The advisory highlights the broad reach of potential compromise, underscoring the importance of timely patching and security diligence within the industrial control systems landscape. This incident serves as a reminder of the ongoing security challenges faced by operational technology (OT) environments, where vulnerabilities in underlying components can have significant operational and safety implications.
This advisory details multiple vulnerabilities within Siemens RUGGEDCOM CROSSBOW, affecting versions prior to 6.0. The flaws include SQL injection, authorization bypass, and sensitive data exposure, stemming from improper input validation and access control. Siemens has released version 6.0 to address these issues, which carry a high severity rating (CVSS 8.8) and impact critical infrastructure sectors globally.