noindex and left out of the sitemap until more data is confirmed.CVE-2025-70873 is a heap memory disclosure in SQLite's zipfile extension, triggered by a crafted ZIP file, that reaches Siemens RUGGEDCOM CROSSBOW Station Access Controller because that product bundles the vulnerable SQLite build; NVD has not yet published its own CVSS score, so this page stays noindex until that analysis lands.
Vulnerability summary
N/A
Not yet scored
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2026-03-12
Published
Vulnerability ID: CVE-2025-70873 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) | cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* | All versions before V6.0 (ships bundled SQLite v3.51.1 or earlier with the vulnerable zipfile extension; fixed in SAC V6.0) |
What this means
CVE-2025-70873 (CWE-244, improper clearing of heap memory before release — information disclosure) affects the zipfile virtual-table extension in SQLite. NVD's description states: "An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file" (NVD).
NVD tracks the CVE with status "Modified" (previously analyzed, then revised) as of 2026-10-26. The CVSS v3.1 score on record — 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — is attributed to a CISA-run NVD-authorized data publisher (ADP) source rather than to NVD's own analysts, so this page leaves cvss_score unset rather than presenting that figure as NVD-confirmed (NVD).
This SQLite flaw reaches an industrial product because Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) ships a bundled copy of the affected SQLite build. CISA's ICS advisory ICSA-26-295-15, republishing Siemens' advisory on 2026-10-22, lists CVE-2025-70873 together with four other third-party SQLite CVEs (CVE-2025-6965, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824) affecting SAC versions before V6.0, states "Siemens ProductCERT reported these vulnerabilities to CISA" after reviewing bundled components, and gives a single remediation for all five: update to SAC V6.0 or later (CISA ICS Advisory ICSA-26-295-15).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00458 (39.435th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, RUGGEDCOM CROSSBOW SAC operators should update to V6.0 or later and avoid opening untrusted ZIP files through the bundled SQLite zipfile extension where it is user-reachable.
Evidence
- The zipfileInflate function in SQLite's zipfile extension (v3.51.1 and earlier) discloses heap memory to an attacker supplying a crafted ZIP file (CWE-244). — NVD
- NVD status is "Modified" with a CISA-ADP-scored CVSS v3.1 7.5 (high); no NVD-published independent score as of 2026-10-26. — NVD
- Bundled in Siemens RUGGEDCOM CROSSBOW SAC before V6.0 alongside four other SQLite CVEs; Siemens ProductCERT reported the issues; fix is SAC V6.0 or later. — CISA ICS Advisory ICSA-26-295-15
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00458 (39.435th percentile) as of 2026-10-26. — FIRST EPSS
