Medium 5.3Published Oct 13, 2026

CVE-2026-89208A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo P…

Updated under an hour ago (2026-10-19 09:40 UTC)

Does this affect you?

It affects Siemens Capital Embedded AR Classic 431-422 and 14 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Siemens Capital Embedded AR Classic 431-422

Exploited in the last 30 days

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: siemens
NVD analysis: Awaiting Analysis
Record last updated: Oct 13, 2026
First seen by InfoSec Signals: Oct 13, 2026

Affected products

Affected products

Siemens Capital Embedded AR Classic 431-422 siemens:capital_embedded_ar_classic_431_422 (from the name)	all versions	CNA record
Siemens Capital Embedded AR Classic R20-11 siemens:capital_embedded_ar_classic_r20_11 (from the name)	before V2303	CNA record
Siemens Desigo PXC00-E.D siemens:desigo_pxc00_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC00-U siemens:desigo_pxc00_u (from the name)	from V2.3	CNA record
Siemens Desigo PXC001-E.D siemens:desigo_pxc001_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC100-E.D siemens:desigo_pxc100_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC12-E.D siemens:desigo_pxc12_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC128-U siemens:desigo_pxc128_u (from the name)	from V2.3	CNA record
Siemens Desigo PXC200-E.D siemens:desigo_pxc200_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC22-E.D siemens:desigo_pxc22_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC22.1-E.D siemens:desigo_pxc22.1_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC36.1-E.D siemens:desigo_pxc36.1_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC50-E.D siemens:desigo_pxc50_e.d (from the name)	from V2.3	CNA record
Siemens Desigo PXC64-U siemens:desigo_pxc64_u (from the name)	from V2.3	CNA record
Siemens Desigo PXM20-E siemens:desigo_pxm20_e (from the name)	from V2.3	CNA record

References

https://cert-portal.siemens.com/productcert/html/ssa-055299.html
https://cert-portal.siemens.com/productcert/html/ssa-333035.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.