CVE-2026-59693

mediumpriority · track · 0EPSS 0.002 · 15 %ileDEEUNLUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.24% (15th) EPSS
CVSS 4.3 · medium
Is it mine?
49 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · cisa_csaf_ot · ncsc_nl

EPSS · scored 2026-10-27

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedDesigo DXR2siemens_psirt

    Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC3siemens_psirt

    Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC4siemens_psirt

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC5.E003siemens_psirt

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC5.E24siemens_psirt

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC7siemens_psirt

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo DXR2cisa_csaf_ot

    Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC3cisa_csaf_ot

    Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC4cisa_csaf_ot

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC5.E003cisa_csaf_ot

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC5.E24cisa_csaf_ot

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

  • FixedDesigo PXC7cisa_csaf_ot

    Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.3–5.3

v3.14.3mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · productcert@siemens.com DEexploitability 2.8 · impact 1.4
v3.14.3mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · CISA US
v3.14.3mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Siemens ProductCERT DE
v3.14.3mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · NCSC-NL NL
v4.05.3mediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.05.3mediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE
v4.01.3lowCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-754USCWE-754USCWE-754USCWE-754US
05

affected products (49)

Products and version ranges known to be affected.

showing 20 of 49
06

advisories (3)

Vendor and ecosystem advisories describing this.

  • NCSC-2026-0282Kwetsbaarheden verholpen in Siemens productenNL2026-08-11csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Parasolid, RUGGEDCOM, SIMATIC, Siveillance en Solid Edge.

  • SSA-781903SSA-781903: Denial of Service Vulnerability in Desigo DXR and PXC Controllers2026-08-11csaf · siemens_psirtDE

    A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • ICSA-26-225-08Siemens Desigo DXR and PXC Controllers2026-08-11icsa · cisa_csaf_otUS

    A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Siemens has released new versions for the affected products and recommends to update to the latest versions.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otncsc_nlsiemens_psirtNVDCVE.orgMITRE
published 2026-08-11modified 2026-08-28
09

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan