[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-siemens-patches-five-sqlite-flaws-in-ruggedcom-crossbow":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12207,"siemens-patches-five-sqlite-flaws-in-ruggedcom-crossbow","Siemens Patches Five SQLite Flaws in RUGGEDCOM CROSSBOW","Five SQLite bugs in Siemens' CROSSBOW Station Access Controller include one rated 9.8 out of 10; version 6.0 fixes all of them.","Anyone running Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) software older than V6.0 should update to V6.0 or later. The advice comes from a Siemens advisory that the US cybersecurity agency CISA republished.\n\nThe problem is SQLite, the small database engine built into the product. The advisory lists five vulnerabilities, which an attacker could use to run arbitrary code, crash the device, or read sensitive information. Siemens ProductCERT, the company's security team, reported them to CISA. The advisory does not say any are being exploited.\n\nThe worst is CVE-2025-71316, scored 9.8 out of 10 (critical). It involves sqldiff.exe, a SQLite utility, which mishandles how Windows converts Unicode characters. A crafted command line can make it load an arbitrary DLL, a code library of the attacker's choosing. The other four score between 7.5 and 7.8:\n\n- CVE-2025-6965: memory corruption in SQLite versions before 3.50.2.\n- CVE-2025-70873: a crafted ZIP file can leak heap memory in SQLite 3.51.1 and earlier.\n- CVE-2026-11822 and CVE-2026-11824: heap overflows in the FTS5 full-text search extension in versions before 3.53.2, triggered by a malicious database and a search query. Both are scored as local attacks needing user interaction, and the second applies only to builds compiled with SQLITE_ENABLE_FTS5.\n\nSiemens lists the product as deployed worldwide, across sectors that include energy, transportation, healthcare and critical manufacturing. Beyond the update, Siemens and CISA advise keeping control devices off the internet, behind firewalls and isolated from business networks, with VPNs where remote access is unavoidable.\n\nThe pattern is familiar: a vendor ships a widely used open-source component, and each bug in that component becomes the vendor's to patch. These five span several SQLite releases, so one product update has to cover a lot of upstream history. What the advisory leaves open is how reachable the sqldiff.exe flaw is on a deployed device, which matters for how urgent that 9.8 really is.","[\"siemens\",\"sqlite\",\"ics-security\",\"vulnerabilities\"]","2026-10-22T12:00:00.000Z","2026-10-22T20:21:38.983Z","2026-10-22T20:21:39.166Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The lede's key date, 'the advisory, published October 22', appears nowhere in the source material, so remove it or replace it with a date the source supports; also make clear that the source is a CISA-republished Siemens advisory.","resolved","security",[32,33,34,35],"siemens","sqlite","ics-security","vulnerabilities",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-295-15",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7065,"2026-10-22T21:51:25.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1057,"2026-10-22T15:11:26.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",574,"2026-10-22T20:23:48.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",559,"2026-10-22T21:00:00.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",288,"2026-10-22T17:25:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",285,"2026-10-22T22:21:59.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",216,"2026-10-22T22:12:19.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",144,"2026-10-22T23:15:00.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",142,"2026-10-23T00:09:58.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",98,"2026-10-22T21:07:09.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",88,"2026-10-22T22:25:33.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]