CVE-2026-89208
5.3MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-125
Impact
Unauthenticated remote attackers can read sensitive device memory over the network. They only need network reachability to the targeted Siemens controllers or embedded software stacks.
Root cause
The software fails to validate input bounds before reading packet data, triggering an out-of-bounds memory read (CWE-125).
Affected systems
Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (< V2303), and Desigo controllers (PXC00-E.D, PXC00-U, PXC001-E.D, PXC100-E.D, PXC12-E.D, PXC128-U, PXC200-E.D, PXC22-E.D, PXC22.1-E.D, PXC36.1-E.D, PXC50-E.D, PXC64-U, PXM20-E) all versions >= V2.3.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade Capital Embedded AR Classic R20-11 to V2303 or newer; for other listed products and interim mitigations, check Siemens advisories SSA-055299 and SSA-333035 and isolate affected devices to restricted OT network segments.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.