Out-of-bounds read in Siemens Capital Embedded and Desigo products
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
Siemens Capital Embedded AR Classic 431-422 (all versions) and Siemens Capital Embedded AR Classic R20-11 before V2303 are affected, as are Siemens Desigo products from V2.3. The affected software does not properly validate input bounds before accessing packet data (CWE-125). An unauthenticated remote attacker can trigger memory reads outside the intended packet boundaries.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Capital Embedded AR Classic 431-422 | all versions | — | No fix listed | CNA |
| Siemens | Capital Embedded AR Classic R20-11 | before V2303 | V2303 | Patch available | CNA |
| Siemens | Desigo PXC00-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC00-U | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC001-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC100-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC12-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC128-U | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC200-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC22-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC22.1-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC36.1-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC50-E.D | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXC64-U | V2.3 and later | — | No fix listed | CNA |
| Siemens | Desigo PXM20-E | V2.3 and later | — | No fix listed | CNA |
- Capital Embedded AR Classic 431-422 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- Capital Embedded AR Classic R20-11 VendorSiemens Affected before V2303 Fixed in V2303 Patch available CNA
- Desigo PXC00-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC00-U VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC001-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC100-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC12-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC128-U VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC200-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC22-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC22.1-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC36.1-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC50-E.D VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXC64-U VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
- Desigo PXM20-E VendorSiemens Affected V2.3 and later Fixed in — No fix listed CNA
Remediation
Siemens Capital Embedded AR Classic R20-11 is fixed in V2303. No fixed version is listed for Siemens Capital Embedded AR Classic 431-422 or for Desigo PXC00-E.D, Desigo PXC00-U, Desigo PXC001-E.D and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA Capital Embedded AR Classic R20-11 (Siemens) Fixed in V2303
Timeline
- 2026-10-13 Threatist record created from CVE-2026-89208
- 2026-10-13 Alias added: GHSA-3f9v-63rg-527j
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → LOW
References
More Siemens vulnerabilities
- TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
- TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-89208 · CVE Program
- CVE-2026-89208 · NVD
- FIRST EPSS
- GHSA-3f9v-63rg-527j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences