CVE-2026-89208

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All…

Medium6.9EPSS 0.26%

Published: 13 Oct 2026
Updated: 13 Oct 2026
Reserved: 11 Sept 2026
Assigned by: siemens

Description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Scores

CVSS scores of CVE-2026-89208, by who scored it
Scored by	CVSS	Score	Vector
siemensCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
siemensCNA (assigner)	3.1	Medium5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Awaiting Analysis	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.26% · top 82% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-125: Out-of-bounds Read (opens in a new tab)All about CWE-125 and its CVEs

Affected products

Siemens · Capital Embedded AR Classic 431-422
- affected < *
Siemens · Capital Embedded AR Classic R20-11
- affected < V2303
Siemens · Desigo PXC00-E.D
- affected V2.3 – < *
Siemens · Desigo PXC00-U
- affected V2.3 – < *
Siemens · Desigo PXC001-E.D
- affected V2.3 – < *
Siemens · Desigo PXC100-E.D
- affected V2.3 – < *
Siemens · Desigo PXC12-E.D
- affected V2.3 – < *
Siemens · Desigo PXC128-U
- affected V2.3 – < *
Siemens · Desigo PXC200-E.D
- affected V2.3 – < *
Siemens · Desigo PXC22-E.D
- affected V2.3 – < *
Siemens · Desigo PXC22.1-E.D
- affected V2.3 – < *
Siemens · Desigo PXC36.1-E.D
- affected V2.3 – < *
Siemens · Desigo PXC50-E.D
- affected V2.3 – < *
Siemens · Desigo PXC64-U
- affected V2.3 – < *
Siemens · Desigo PXM20-E
- affected V2.3 – < *

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-89208](https://trackcve.app/badge/CVE-2026-89208.svg)](https://trackcve.app/cve/CVE-2026-89208)

Record last updated 13 Oct 2026, 16:20 UTC.