attack vector is local; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) and SQLite sqlite
Classified as
CWE-122 (Heap-based Buffer Overflow)
Exploitation prediction (EPSS)
0.29% probability of exploitation in the next 30 days (21% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Siemens
RUGGEDCOM CROSSBOW Station Access Controller (SAC)
SQLite
sqlite
Subsystems
General OT
Sectors
Multiple
What to Know
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database. (NVD)
What to Do
Monitor Siemens's and SQLite's web pages for any future patch releases.