attack vector is local; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) and SQLite sqlite
Classified as
CWE-122 (Heap-based Buffer Overflow)
Exploitation prediction (EPSS)
0.18% probability of exploitation in the next 30 days (7% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Siemens
RUGGEDCOM CROSSBOW Station Access Controller (SAC)
SQLite
sqlite
Subsystems
General OT
Sectors
Multiple
What to Know
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5. (NVD)
What to Do
Monitor Siemens's and SQLite's web pages for any future patch releases.