Anyone running Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) software older than V6.0 should update to V6.0 or later. The advice comes from a Siemens advisory that the US cybersecurity agency CISA republished.
The problem is SQLite, the small database engine built into the product. The advisory lists five vulnerabilities, which an attacker could use to run arbitrary code, crash the device, or read sensitive information. Siemens ProductCERT, the company's security team, reported them to CISA. The advisory does not say any are being exploited.
The worst is CVE-2025-71316, scored 9.8 out of 10 (critical). It involves sqldiff.exe, a SQLite utility, which mishandles how Windows converts Unicode characters. A crafted command line can make it load an arbitrary DLL, a code library of the attacker's choosing. The other four score between 7.5 and 7.8:
- CVE-2025-6965: memory corruption in SQLite versions before 3.50.2.
- CVE-2025-70873: a crafted ZIP file can leak heap memory in SQLite 3.51.1 and earlier.
- CVE-2026-11822 and CVE-2026-11824: heap overflows in the FTS5 full-text search extension in versions before 3.53.2, triggered by a malicious database and a search query. Both are scored as local attacks needing user interaction, and the second applies only to builds compiled with SQLITE_ENABLE_FTS5.
Siemens lists the product as deployed worldwide, across sectors that include energy, transportation, healthcare and critical manufacturing. Beyond the update, Siemens and CISA advise keeping control devices off the internet, behind firewalls and isolated from business networks, with VPNs where remote access is unavoidable.
The pattern is familiar: a vendor ships a widely used open-source component, and each bug in that component becomes the vendor's to patch. These five span several SQLite releases, so one product update has to cover a lot of upstream history. What the advisory leaves open is how reachable the sqldiff.exe flaw is on a deployed device, which matters for how urgent that 9.8 really is.