noindex and left out of the sitemap until more data is confirmed.CVE-2025-71316 is a Unicode/ANSI argument-handling flaw in SQLite's sqldiff.exe utility that lets an attacker abuse the '-L' option to load an arbitrary DLL via a crafted command-line argument string, and it reaches Siemens RUGGEDCOM CROSSBOW Station Access Controller because that product bundles the vulnerable SQLite build; NVD has not yet published its own CVSS score, so this page stays noindex until that analysis lands.
Vulnerability summary
N/A
Not yet scored
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2026-06-04
Published
Vulnerability ID: CVE-2025-71316 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) | — | All versions before V6.0 (ships a vulnerable bundled SQLite sqldiff.exe utility; upstream SQLite fixed around 2025-12-26, Siemens fix available in SAC V6.0) |
What this means
CVE-2025-71316 (CWE-176, improper handling of Unicode encoding) affects the sqldiff.exe command-line utility distributed with SQLite. NVD's description states the tool "does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages," and that "an attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options" (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-26. The only severity data on record comes from CISA, acting as an NVD-authorized data publisher (ADP) rather than NVD's own analysts: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 9.2 (critical). NVD has not published an independent score, so this page leaves cvss_score unset rather than presenting the ADP figure as NVD-confirmed (NVD).
This particular SQLite flaw reaches an industrial product because Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) ships a bundled copy of the affected sqldiff.exe utility. CISA's ICS advisory ICSA-26-295-15, republishing Siemens' advisory on 2026-10-22, lists CVE-2025-71316 together with four other third-party SQLite CVEs (CVE-2025-6965, CVE-2025-70873, CVE-2026-11822, CVE-2026-11824) affecting SAC versions before V6.0, states "Siemens ProductCERT reported these vulnerabilities to CISA" after reviewing bundled components, and gives a single remediation for all five: update to SAC V6.0 or later (CISA ICS Advisory ICSA-26-295-15).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00544 (45.392th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, RUGGEDCOM CROSSBOW SAC operators should update to V6.0 or later and follow Siemens' general operational-security guidance for restricting network access to control-system devices.
Evidence
- sqldiff.exe mishandles Windows Unicode-to-ANSI conversion; the '-L' option can be abused with a crafted argument string so file-path arguments are misread as options, resulting in an arbitrary DLL load (CWE-176). — NVD
- NVD status is "Awaiting Analysis" with a CISA-ADP-scored CVSS v3.1 9.8 (critical) and CVSS v4.0 9.2 (critical); no NVD-published independent score as of 2026-10-26. — NVD
- Bundled in Siemens RUGGEDCOM CROSSBOW SAC before V6.0 alongside four other SQLite CVEs; Siemens ProductCERT reported the issues; fix is SAC V6.0 or later. — CISA ICS Advisory ICSA-26-295-15
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00544 (45.392th percentile) as of 2026-10-26. — FIRST EPSS
