SSA-994087: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Before V5.7
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code or to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-3277US | critical9.8 | — | ||
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting s… | ||||
| CVE-2025-29088US | medium5.5 | — | ||
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is… | ||||
| CVE-2025-29087US | high7.5 | — | ||
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is… | ||||
references
External citations — patches, advisories, analysis.
remediations (3)
- FixedRUGGEDCOM CROSSBOW Station Access Controller (SAC)
Update to V5.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109989951/ - FixedRUGGEDCOM CROSSBOW Station Access Controller (SAC)
Update to V5.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109989951/ - FixedRUGGEDCOM CROSSBOW Station Access Controller (SAC)
Update to V5.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109989951/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan