ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-89208

Siemens Capital Embedded AR Classic

Published Oct 13, 2026 · catalog updated Oct 13, 2026 · Siemens Capital Embedded AR Classic 431-422

Last checked Oct 25, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-89208. EPSS is 0.26%. Act only if a listed version of Siemens Capital Embedded AR Classic 431-422 is installed.

Gaps on this record

  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.26%
Remediation
Not established
Affected products
vendor Siemens Capital Embedded AR Classic 431-422 · vendor Siemens Capital Embedded AR Classic R20-11 · vendor Siemens Desigo PXC00-E.D · vendor Siemens Desigo PXC00-U · vendor Siemens Desigo PXC001-E.D · vendor Siemens Desigo PXC100-E.D

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor Siemens Capital Embedded AR Classic 431-422version unspecified
  • vendor Siemens Capital Embedded AR Classic R20-11version unspecified
  • vendor Siemens Desigo PXC00-E.Dversion unspecified
  • vendor Siemens Desigo PXC00-Uversion unspecified
  • vendor Siemens Desigo PXC001-E.Dversion unspecified
  • vendor Siemens Desigo PXC100-E.Dversion unspecified
  • vendor Siemens Desigo PXC12-E.Dversion unspecified
  • vendor Siemens Desigo PXC128-Uversion unspecified

How to fix CVE-2026-89208

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-89208. EPSS is 0.26%. Act only if a listed version of Siemens Capital Embedded AR Classic 431-422 is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-125: Out-of-bounds Read. EPSS 0.26%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · CVE.org

    Updated

    A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desig

  2. Oct 22, 2026 · CISA ICS Advisories

    Detected

    View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for produ

Sources

  • CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2026-89208

    View CSAF Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to

    cisa.gov
  • CISA ICS AdvisoriesGovernment advisoryCVE-2026-89208

    View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends upd

    cisa.gov
  • CVE.orgVulnerability recordCVE-2026-89208

    A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo P

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-89208

    30-day exploitation probability 0.26%

    first.org

References

Freshness

Last verified in this catalog Oct 25, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSOct 25, 2026
  • CISA Cybersecurity AdvisoriesOct 24, 2026
  • CVE.orgOct 23, 2026
  • CISA ICS AdvisoriesOct 23, 2026