CVE-2026-89208

mediumpriority · track · 21EPSS 0.004 · 36 %ileDEFRNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.42% (36th) EPSS

CVSS 5.3 · medium

Is it mine?

279 products

Check your exposure

Who says so?

4 sources

cisa_csaf_ot · ncsc_nl · siemens_psirt · certfr

EPSS · scored 2026-10-24

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCapital Embedded AR Classic R20-11siemens_psirt
Update to V2303 or later version
FixedCapital Embedded AR Classic R20-11cisa_csaf_ot
Update to V2303 or later version
MitigationCapital Embedded AR Classic 431-422siemens_psirt
Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
MitigationCapital Embedded AR Classic R20-11siemens_psirt
Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
MitigationDesigo PXC00-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC00-Usiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC001-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC100-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC12-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC128-Usiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC200-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC22-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC22.1-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC36.1-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC50-E.Dsiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC64-Usiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXM20-Esiemens_psirt
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationCapital Embedded AR Classic 431-422cisa_csaf_ot
Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
MitigationCapital Embedded AR Classic R20-11cisa_csaf_ot
Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
MitigationDesigo PXC00-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC00-Ucisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC001-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC100-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC12-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC128-Ucisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC200-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC22-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC22.1-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC36.1-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC50-E.Dcisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXC64-Ucisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
MitigationDesigo PXM20-Ecisa_csaf_ot
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
No fix plannedCapital Embedded AR Classic 431-422siemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC00-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC00-Usiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC001-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC100-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC12-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC128-Usiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC200-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC22-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC22.1-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC36.1-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC50-E.Dsiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXC64-Usiemens_psirt
Currently no fix is planned
No fix plannedDesigo PXM20-Esiemens_psirt
Currently no fix is planned
No fix plannedCapital Embedded AR Classic 431-422cisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC00-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC00-Ucisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC001-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC100-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC12-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC128-Ucisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC200-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC22-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC22.1-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC36.1-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC50-E.Dcisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXC64-Ucisa_csaf_ot
Currently no fix is planned
No fix plannedDesigo PXM20-Ecisa_csaf_ot
Currently no fix is planned

cvss

Technical severity, 0–10. One row per scoring source.

6.9

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · productcert@siemens.com DEexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · Siemens ProductCERT DE

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.02.7lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-125USCWE-125USCWE-125US

affected products (279)

Products and version ranges known to be affected.

Siemens Capital Embedded AR Classic 431-422≤ vers:all/*cisa_csaf_otUS
Siemens Capital Embedded AR Classic R20-11≤ vers:intdot/<2303cisa_csaf_otUS
Siemens Desigo PXC00-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC00-U≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC001-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC100-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC12-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC128-U≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC200-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC22-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC22.1-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC36.1-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC50-E.D≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXC64-U≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens Desigo PXM20-E≤ vers:intdot/>=2.3cisa_csaf_otUS
Siemens .NET Client Library for SIMATIC S7 Webserver API≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC00-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC00-U≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC001-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC100-E.D≤ vers:unknown/*ncsc_nlNL

showing 20 of 279

advisories (6)

Vendor and ecosystem advisories describing this.

NCSC-2026-0415Kwetsbaarheden verholpen in Siemens-productenNL2026-10-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.
SSA-055299SSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic2026-10-13csaf · siemens_psirtDE
The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
SSA-333035SSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products2026-10-13csaf · siemens_psirtDE
The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.
ICSA-26-295-04Siemens Capital Embedded AR Classic2026-10-13icsa · cisa_csaf_otUS
The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
ICSA-26-295-08Siemens APOGEE, TALON and Desigo PXC/PXM Products2026-10-13icsa · cisa_csaf_otUS
The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.
CERTFR-2026-AVI-1298Multiples vulnérabilités dans les produits SiemensFrançais2026-10-13vendor · certfrFR

sources

Which sources assert this record, and when.

cisa_csaf_ot ncsc_nl siemens_psirt certfr NVD CVE.org MITRE

published 2026-10-13modified 2026-10-15

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan