SSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller

CRITICAL

CVSS 9.8

Date 2026-10-13T00:00:00+00:00

Source siemens-productcert

Published by Siemens ProductCERT

// Description

RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.

// Vulnerabilities (5)

CVE ID	CVSS Score	Severity	Description
CVE-2025-71316	9.8	critical	CVE-2025-71316. SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.
CVE-2025-6965	7.7	high	CVE-2025-6965. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
CVE-2026-11824	7.8	high	CVE-2026-11824. SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
CVE-2025-70873	7.5	high	CVE-2025-70873. An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
CVE-2026-11822	7.8	high	CVE-2026-11822. SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.

// Remediations (11)

Patch: Update to V6.0 or later version

Update to V6.0 or later version

Patch: Update to V5.8 or later version

Update to V5.8 or later version

Patch: Update to V4.0.800 or later version

Update to V4.0.800 or later version

Patch: The problem is corrected in the following product versions: B&R Automation Studio 6.5 B&R recommen

The problem is corrected in the following product versions: B&R Automation Studio 6.5 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

Mitigation: Refer to section “General security recommendations” for advice on how to keep your system secure.

Refer to section “General security recommendations” for advice on how to keep your system secure.

Patch: The problem is corrected in the following product versions: - ABB Ability Camera Connect 2.0.0.49. T

The problem is corrected in the following product versions: - ABB Ability Camera Connect 2.0.0.49. The easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.

Mitigation: While this vulnerability has a CVSS v4.0 score of 6.9 and theoretically allows arbitrary code execut

While this vulnerability has a CVSS v4.0 score of 6.9 and theoretically allows arbitrary code execution, Camera Connect's deployment model provides significant protection: - Function-Specific Vulnerability: The vulnerability requires specific use of the concat_ws() SQL function, which is not utilized in Camera Connect's standard database operations. - Input Validation: Camera Connect implements input validation and sanitization mechanisms that limit the ability to craft malicious SQL queries. - Network Isolation: As an ISA-95 Level 2 OT solution, Camera Connect operates within protected industrial networks with limited external connectivity. - Authenticated Access Required: Database operations in Camera Connect require user authentication and are performed within the context of the application's business logic rather than through direct user-supplied SQL. - Memory Protection: Modern operating systems deployed in industrial environments typically include memory protection mechanisms (DEP, ASLR) that make heap exploitation more difficult. The risk is further reduced by operational procedures requiring change management and validation testing before any modifications to the system configuration or database queries.