Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by siemens

CVE-2026-89208

Medium 5.3

In plain English

A medium-severity out-of-bounds read in Capital Embedded AR Classic 431-422 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 81.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Affected products (as reported)

VendorProductVersions
Siemens Capital Embedded AR Classic 431-422 0 – before *
Siemens Capital Embedded AR Classic R20-11 0 – before V2303
Siemens Desigo PXC00-E.D V2.3 – before *
Siemens Desigo PXC00-U V2.3 – before *
Siemens Desigo PXC001-E.D V2.3 – before *
Siemens Desigo PXC100-E.D V2.3 – before *
Siemens Desigo PXC12-E.D V2.3 – before *
Siemens Desigo PXC128-U V2.3 – before *
Siemens Desigo PXC200-E.D V2.3 – before *
Siemens Desigo PXC22-E.D V2.3 – before *
Siemens Desigo PXC22.1-E.D V2.3 – before *
Siemens Desigo PXC36.1-E.D V2.3 – before *
Siemens Desigo PXC50-E.D V2.3 – before *
Siemens Desigo PXC64-U V2.3 – before *
Siemens Desigo PXM20-E V2.3 – before *

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References