Full Report
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW SAC
## CVE Details
- **CVE ID:** CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824
- **CVSS Score:** 9.8 (Critical) - *Based on the highest score provided (CVE-2025-71316)*
- **CWE:**
- CWE-176: Improper Handling of Unicode Encoding
- CWE-122: Heap-based Buffer Overflow
- CWE-197: Numeric Truncation Error
- CWE-244: Improper Clearing of Heap Memory Before Release
## Affected Systems
- **Products:** RUGGEDCOM CROSSBOW Station Access Controller (SAC)
- **Versions:** All versions prior to V6.0
- **Configurations:** Systems utilizing the integrated SQLite component, particularly those using the FTS5 extension or `sqldiff.exe`.
## Vulnerability Description
RUGGEDCOM CROSSBOW SAC incorporates a version of SQLite that contains several critical flaws:
1. **Arbitrary Code Execution & DLL Sideloading:** Improper handling of Unicode-to-ANSI conversion in `sqldiff.exe` allows attackers to load malicious DLLs via crafted command-line arguments (CVE-2025-71316).
2. **Memory Corruption & Heap Overflows:** Multiple flaws in the FTS5 full-text search extension and aggregate term handling can lead to heap-based buffer overflows or integer underflows when processing crafted databases or ZIP files (CVE-2026-11822, CVE-2026-11824, CVE-2025-6965).
3. **Information Disclosure:** A flaw in the `zipfileInflate` function allows for the inspection of heap memory, potentially exposing sensitive data (CVE-2025-70873).
## Exploitation
- **Status:** PoC availability not explicitly stated; no reports of exploitation in the wild at this time.
- **Complexity:** Low to Medium (Varies by CVE; DLL loading is Low, memory corruption in FTS5 is Medium).
- **Attack Vector:** Network (for most CVEs) | Local (for FTS5/Memory corruption flaws).
## Impact
- **Confidentiality:** High (Information disclosure and data theft via arbitrary code execution).
- **Integrity:** High (Arbitrary code execution and unauthorized modification).
- **Availability:** High (Denial of Service through process crashes or memory exhaustion).
## Remediation
### Patches
- **Update to Version 6.0 or later:** Siemens has released RUGGEDCOM CROSSBOW SAC V6.0 which addresses these integrated SQLite vulnerabilities.
- Patch Link: hxxps://support[.]industry[.]siemens[.]com/cs/ww/en/view/110006651/
### Workarounds
- Protect network access to devices using firewalls and network segmentation.
- Ensure the device operates within a protected IT environment following Siemens’ Industrial Security guidelines.
- Restrict the ability to run arbitrary command-line arguments or load unverified database/ZIP files.
## Detection
- **Indicators of Compromise:** Unexpected crashes of SQLite-related processes, unauthorized DLLs in the application directory, or unusual heap memory growth.
- **Detection methods and tools:** Monitor system logs for `sqldiff.exe` execution with suspicious arguments. Use EDR/AV tools to scan for unauthorized DLL injections.
## References
- **Siemens Security Advisory (SSA-765416):** hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-765416[.]html
- **Siemens Industrial Security Guidelines:** hxxps://www[.]siemens[.]com/cert/operational-guidelines-industrial-security
- **Siemens ProductCERT:** hxxps://www[.]siemens[.]com/cert/advisories