CVE-2026-89208

mediumPriorität · verfolgen · 21EPSS 0.004 · 36. PerzentilDEFRNLUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.42% (36th) EPSS
CVSS 5.3 · medium
Is it mine?
279 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cisa_csaf_ot · ncsc_nl · siemens_psirt · certfr

EPSS · bewertet 2026-10-24

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenCapital Embedded AR Classic R20-11siemens_psirt

    Update to V2303 or later version

  • BehobenCapital Embedded AR Classic R20-11cisa_csaf_ot

    Update to V2303 or later version

  • MitigationCapital Embedded AR Classic 431-422siemens_psirt

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationCapital Embedded AR Classic R20-11siemens_psirt

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationDesigo PXC00-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC00-Usiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC001-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC100-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC12-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC128-Usiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC200-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC22-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC22.1-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC36.1-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC50-E.Dsiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC64-Usiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXM20-Esiemens_psirt

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationCapital Embedded AR Classic 431-422cisa_csaf_ot

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationCapital Embedded AR Classic R20-11cisa_csaf_ot

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationDesigo PXC00-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC00-Ucisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC001-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC100-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC12-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC128-Ucisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC200-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC22-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC22.1-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC36.1-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC50-E.Dcisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXC64-Ucisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • MitigationDesigo PXM20-Ecisa_csaf_ot

    &nbsp;CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

  • Kein Fix geplantCapital Embedded AR Classic 431-422siemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC00-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC00-Usiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC001-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC100-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC12-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC128-Usiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC200-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC22-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC22.1-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC36.1-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC50-E.Dsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC64-Usiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantDesigo PXM20-Esiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantCapital Embedded AR Classic 431-422cisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC00-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC00-Ucisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC001-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC100-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC12-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC128-Ucisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC200-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC22-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC22.1-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC36.1-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC50-E.Dcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXC64-Ucisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantDesigo PXM20-Ecisa_csaf_ot

    Currently no fix is planned

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.9
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 2.7–6.9

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · productcert@siemens.com DEAusnutzbarkeit 3.9 · Auswirkung 1.4
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · Siemens ProductCERT DE
v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE
v4.02.7lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-125USCWE-125USCWE-125US
05

betroffene Produkte (279)

Betroffene Produkte und Versionsbereiche.

20 von 279 angezeigt
06

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

  • NCSC-2026-0415Kwetsbaarheden verholpen in Siemens-productenNL2026-10-13csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.

  • SSA-055299SSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic2026-10-13csaf · siemens_psirtDE

    The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

  • SSA-333035SSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products2026-10-13csaf · siemens_psirtDE

    The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.

  • ICSA-26-295-04Siemens Capital Embedded AR Classic2026-10-13icsa · cisa_csaf_otUS

    The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

  • ICSA-26-295-08Siemens APOGEE, TALON and Desigo PXC/PXM Products2026-10-13icsa · cisa_csaf_otUS

    The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.

  • CERTFR-2026-AVI-1298Multiples vulnérabilités dans les produits SiemensFrançais2026-10-13vendor · certfrFR
07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cisa_csaf_otncsc_nlsiemens_psirtcertfrNVDCVE.orgMITRE
veröffentlicht 2026-10-13geändert 2026-10-15
08

Referenzen (2) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan