CVE-2026-89208

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-15
Weakness: CWE-125

Description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Affected products

Siemens Capital Embedded AR Classic 431-422: all versions
Siemens Capital Embedded AR Classic R20-11: before V2303 — fixed in V2303
Siemens Desigo PXC00-E.D: from V2.3
Siemens Desigo PXC00-U: from V2.3
Siemens Desigo PXC001-E.D: from V2.3
Siemens Desigo PXC100-E.D: from V2.3
Siemens Desigo PXC12-E.D: from V2.3
Siemens Desigo PXC128-U: from V2.3
Siemens Desigo PXC200-E.D: from V2.3
Siemens Desigo PXC22-E.D: from V2.3
Siemens Desigo PXC22.1-E.D: from V2.3
Siemens Desigo PXC36.1-E.D: from V2.3
Siemens Desigo PXC50-E.D: from V2.3
Siemens Desigo PXC64-U: from V2.3
Siemens Desigo PXM20-E: from V2.3

How to fix

Upgrade to a fixed version: Siemens Capital Embedded AR Classic R20-11 V2303. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89208 or the next vulnerability affects your stack