# ABB B&R Automation Studio <6.5: Multiple Critical SQLite Vulnerabilities

> Critical SQLite vulnerabilities in ABB B&R Automation Studio <6.5 expose ICS to RCE, data exposure, and unauthorized access. Update to version 6.5 immediately.

- Published: 2026-05-23T00:56:27.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: ABB, B R Automation Studio, SQLite, ICS, OT, CVE-2025-6965, CVE-2025-3277, CVE-2019-19646, CVE-2019-8457, CVE-2017-10989, RCE, Buffer Overflow, Memory Corruption, Zero Trust
- Author: Runtime Rebel Intel
- Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03
- Canonical: https://runtimerebel.com/blog/abb-b-r-automation-studio-6-5-multiple-critical-sqlite-vulnerabilities

## Key points

- Immediate impact: Critical vulnerabilities in ABB B&R Automation Studio <6.5 allow unauthorized access, data exposure, or remote code execution in energy sector ICS environments.
- Affected systems: ABB B&R Automation Studio versions prior to 6.5, which embed vulnerable SQLite components.
- Remediation: Upgrade ABB B&R Automation Studio to version 6.5 immediately to patch these critical security flaws.

## Overview of Critical Vulnerabilities in ABB B&R Automation Studio

ABB has identified and addressed a series of critical vulnerabilities stemming from an outdated third-party component, SQLite, embedded within its B&R Automation Studio software. These security flaws, primarily affecting versions prior to 6.5, pose significant risks including potential for unauthorized access, data exposure, or [RCE](/glossary#rce). While no successful exploitation has been observed during vendor testing, the presence of multiple vulnerabilities with [CVSS](/glossary#cvss) scores as high as 9.8 highlights the urgency for affected organizations to update.

This advisory, republished by [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03), is particularly relevant for critical infrastructure sectors, especially the Energy sector, where ABB B&R Automation Studio is deployed worldwide. Security professionals must prioritize remediation to safeguard operational technology (OT) environments.

## Technical Analysis of Embedded SQLite Flaws

The core of the identified issues lies within various versions of the SQLite database component utilized by ABB B&R Automation Studio. A comprehensive review reveals a multitude of vulnerabilities, ranging from heap-based buffer overflows to integer overflows and improper input validations. These flaws create attack vectors that, if exploited, could severely compromise the integrity and availability of industrial control systems (ICS).

Among the most critical issues are:

*   **[CVE-2025-6965](https://nvd.nist.gov/vuln/detail/CVE-2025-6965)**: A numeric truncation error in SQLite that could lead to memory corruption, rated at [CVSS](/glossary#cvss) 9.8 (Critical).
*   **[CVE-2025-3277](https://nvd.nist.gov/vuln/detail/CVE-2025-3277)**: An integer overflow within SQLite's `concat_ws()` function, resulting in a substantial heap-based buffer overflow of approximately 4GB. This also carries a [CVSS](/glossary#cvss) score of 9.8 (Critical).
*   **[CVE-2019-19646](https://nvd.nist.gov/vuln/detail/CVE-2019-19646)**: An improper check for unusual conditions in `pragma.c` that, in certain circumstances involving generated columns, can lead to critical compromise (CVSS 9.8).
*   **[CVE-2019-8457](https://nvd.nist.gov/vuln/detail/CVE-2019-8457)**: A heap out-of-bounds read in the `rtreenode()` function when processing invalid RTree tables. This vulnerability is rated 9.8 (Critical).
*   **[CVE-2017-10989](https://nvd.nist.gov/vuln/detail/CVE-2017-10989)**: A heap-based buffer over-read in `getNodeSize` function related to undersized RTree blobs, also with a critical [CVSS](/glossary#cvss) score of 9.8.
*   **[CVE-2015-5895](https://nvd.nist.gov/vuln/detail/CVE-2015-5895)**: Multiple unspecified vulnerabilities in older SQLite versions that could lead to exposure of sensitive information to an unauthorized actor, rated 9.8 (Critical).

Other notable vulnerabilities include several heap-based buffer overflows ([CVE-2023-7104](https://nvd.nist.gov/vuln/detail/CVE-2023-7104), [CVE-2020-15358](https://nvd.nist.gov/vuln/detail/CVE-2020-15358)), use-after-free conditions ([CVE-2020-13630](https://nvd.nist.gov/vuln/detail/CVE-2020-13630), [CVE-2020-11656](https://nvd.nist.gov/vuln/detail/CVE-2020-11656)), and integer overflows ([CVE-2018-20506](https://nvd.nist.gov/vuln/detail/CVE-2018-20506), [CVE-2018-20346](https://nvd.nist.gov/vuln/detail/CVE-2018-20346), [CVE-2015-3416](https://nvd.nist.gov/vuln/detail/CVE-2015-3416)), all of which present various levels of risk, including denial of service and potential [Privilege Escalation](/glossary#privilege-escalation).

These issues collectively highlight the risk associated with relying on outdated software components, especially in critical [ICS](/glossary#ics) environments. Attackers could potentially chain these vulnerabilities to achieve sophisticated attacks targeting operational stability and data confidentiality. Effectively addressing SQLite heap-based buffer overflow mitigation and other memory corruption issues is paramount for system owners.

## Actionable Recommendations and Mitigations

Defenders must act promptly to address these vulnerabilities in ABB B&R Automation Studio deployments. Prioritizing updates and implementing robust security practices for [ICS](/glossary#ics) and OT environments is essential.

### Addressing ABB B&R Automation Studio <6.5 Security Update

*   **Immediate Update**: The primary recommendation is to update ABB B&R Automation Studio to version 6.5. This version incorporates the necessary fixes to replace the outdated and vulnerable third-party SQLite component. B&R recommends applying this update at the earliest convenience. Consult the user manual for instructions on identifying the installed product version and installing updates.

### General Security Recommendations for ICS Environments

In addition to applying the vendor fix, CISA recommends implementing the following defensive measures to minimize exploitation risk and strengthen the security posture of [ICS](/glossary#ics) assets:

*   **Network Segmentation**: Minimize network exposure for all control system devices and systems. Ensure that these critical assets are isolated from business networks and not directly accessible from the internet. Employ network segmentation and firewalls to create clear security boundaries.
*   **Secure Remote Access**: When remote access is indispensable, utilize secure methods such as Virtual Private Networks (VPNs). Regularly update VPNs to the most recent versions, acknowledging that a VPN's security is contingent on the security of its connected devices.
*   **Principle of Least Privilege**: Implement the principle of least privilege for all user accounts and services. Restrict permissions to only what is necessary for operations.
*   **Defense-in-Depth Strategies**: Implement a comprehensive defense-in-depth approach. This includes a layered security architecture that combines administrative, technical, and physical controls to protect [ICS](/glossary#ics) assets. This contributes significantly to [defending ICS against remote code execution](https://www.cisa.gov/resources-tools/resources/improving-industrial-control-systems-cybersecurity-defense-depth-strategies) attempts.
*   **Risk Assessment and Impact Analysis**: Before deploying any defensive measures, conduct a thorough impact analysis and risk assessment to understand potential operational consequences.
*   **Monitor and Report**: Actively monitor [ICS](/glossary#ics) networks for suspected malicious activity. Establish internal procedures for incident response and report findings to CISA for broader tracking and correlation against other incidents. Adopting a [Zero Trust](/glossary#zero-trust) architecture can further enhance detection and response capabilities.

**Related:** [ABB Symphony Plus Engineering: Fix PostgreSQL RCE Vulnerabilities](/blog/abb-symphony-plus-engineering-fix-postgresql-rce-vulnerabilities), [CVE-2026-3094: Delta CNCSoft-G2 Out-of-bounds Write RCE](/blog/cve-2026-3094-delta-cncsoft-g2-out-of-bounds-write-rce)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/abb-b-r-automation-studio-6-5-multiple-critical-sqlite-vulnerabilities