# Siemens RUGGEDCOM CROSSBOW SQLite flaws patched

Published: 2026-10-22 · Severity: high · Sectors: Manufacturing, Transportation, Energy, Healthcare, Financial Services, Government (National)
Canonical: https://vorant.io/reports/6f36cb74-7775-54e5-af3c-be1f92c8ba6b/siemens-ruggedcom-crossbow-sqlite-flaws-patched

> Siemens patched five SQLite-related vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller before V6.0, enabling RCE, DoS, or info disclosure; update to V6.0+.

Siemens disclosed five vulnerabilities affecting the integrated SQLite component used in RUGGEDCOM CROSSBOW Station Access Controller (SAC) versions prior to V6.0. The flaws stem from upstream SQLite issues including a numeric truncation error in aggregate term handling (CVE-2025-6965), a heap memory disclosure in the zipfile extension's inflate function (CVE-2025-70873), insecure Unicode-to-ANSI conversion in sqldiff.exe enabling arbitrary DLL loading via the '-L' option (CVE-2025-71316), and two heap-based buffer overflow vulnerabilities in the FTS5 full-text search extension (CVE-2026-11822 and CVE-2026-11824) that can be triggered via crafted database files during FTS5 MATCH queries, leading to crashes, memory exhaustion, or arbitrary code execution.

The advisory, republished verbatim by CISA from Siemens ProductCERT SSA-765416, affects worldwide deployments across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities sectors. A CVSS v3 score of 9.8 is noted for the overall advisory, indicating high severity for the most impactful flaw(s). Siemens' remediation for all five CVEs is the same: update RUGGEDCOM CROSSBOW SAC to version 6.0 or later. There is no indication of active exploitation in the wild; these are vendor-disclosed vulnerabilities in a bundled third-party component (SQLite) rather than a targeted campaign.

Defenders operating RUGGEDCOM CROSSBOW SAC should prioritize patching to V6.0+ and, per standard ICS guidance, minimize network exposure of control system devices, avoid direct internet accessibility, and isolate control networks behind firewalls with VPN-only remote access where required.

## Mentioned in this report

- Vulnerabilities: CVE-2025-6965 (poc), CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824

## Detection guidance (public sample)

### SQLite sqldiff.exe Launched With Extension Library Load Option

ATT&CK: T1574.001

sqldiff.exe started with -L/--lib to load an arbitrary library; the advisory ties this option to arbitrary DLL loading (CVE-2025-71316). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQLite sqldiff.exe Launched With Extension Library Load Option
description: Detects sqldiff.exe executed with the -L / --lib option, which loads
  an arbitrary library into the process. The advisory associates this option with
  arbitrary DLL loading (CVE-2025-71316). Rare outside SQLite developer workstations.
tags:
- attack.stealth
- attack.privilege-escalation
- attack.persistence
- attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \sqldiff.exe
  selection_opt:
    CommandLine|contains|windash:
    - ' -L '
    - ' --lib '
  condition: selection_img and selection_opt
falsepositives:
- Developers or DBAs deliberately loading a legitimate SQLite extension while diffing
  databases
level: medium
id: d8cb1730-cb70-5851-93b2-e3b81592c0d5
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
```

### SQLite sqldiff.exe Loading DLL From User-Writable Path

ATT&CK: T1574.001

sqldiff.exe loading a DLL from temp, public, downloads or profile paths, consistent with the -L arbitrary DLL load flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQLite sqldiff.exe Loading DLL From User-Writable Path
description: Detects sqldiff.exe loading a DLL from user-writable locations such as
  Temp, Users\Public or Downloads, consistent with abuse of the -L option to load
  an attacker-supplied library (CVE-2025-71316).
tags:
- attack.stealth
- attack.privilege-escalation
- attack.persistence
- attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \sqldiff.exe
    ImageLoaded|contains:
    - \Temp\
    - \Users\Public\
    - \Downloads\
    - \AppData\Local\Temp\
  condition: selection
falsepositives:
- Developers testing SQLite extensions built in a temporary or download directory
level: medium
id: e80daeb5-a411-5b8b-ac0f-dfdaeb827dcb
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6f36cb74-7775-54e5-af3c-be1f92c8ba6b/siemens-ruggedcom-crossbow-sqlite-flaws-patched.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup