Input Validation Flaw in Siemens Desigo and Capital Embedded Products
CVE-2026-89208

6.9MEDIUM

Key Information:

Vendor

Siemens
Status
Capital Embedded Ar Classic 431-422
Capital Embedded Ar Classic R20-11
Desigo Pxc00-e.d
Desigo Pxc00-u
Vendor
CVE Published:
13 October 2026

What is CVE-2026-89208?

A significant input validation flaw has been discovered across several Siemens products, which fails to accurately check input bounds when handling packet data. This vulnerability allows a remote attacker, without authentication, to manipulate memory access, potentially leading to unauthorized information disclosure or disruption of service. Urgent measures are recommended to mitigate the risks associated with this issue.

Affected Version(s)

Capital Embedded AR Classic 431-422 0

Capital Embedded AR Classic R20-11 0

Desigo PXC00-E.D V2.3

References

https://cert-portal.siemens.com/productcert/html/ssa-0552...
https://cert-portal.siemens.com/productcert/html/ssa-3330...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.