Siemens RUGGEDCOM CROSSBOW controller has critical SQLite flaw, CVSS 9.8
CISA has republished a Siemens ProductCERT advisory detailing five vulnerabilities in the SQLite component embedded in RUGGEDCOM CROSSBOW Station Access Controller software used across critical infrastructure sectors. One flaw carries a CVSS v3 score of 9.8. Security and OT teams running affected versions should assess exposure and schedule the vendor update.
- Siemens has released RUGGEDCOM CROSSBOW SAC version V6.0 to remediate all five listed vulnerabilities, and recommends updating from any version below V6.0.
- CVE-2025-71316 is rated CVSS v3 9.8, critical, and involves insecure handling of Unicode-to-ANSI conversion in SQLite's sqldiff.exe that could allow an attacker to load an arbitrary DLL.
- CVE-2026-11822 and CVE-2026-11824 affect SQLite versions before 3.53.2 and involve heap-based buffer overflows in the FTS5 full-text search extension triggered via crafted database files.
- CVE-2025-6965 affects SQLite versions before 3.50.2 and can cause memory corruption when aggregate terms exceed available columns.
- Siemens ProductCERT reported the vulnerabilities to CISA, and the advisory is a verbatim republication of Siemens advisory SSA-765416.