CVE-2026-89208: Capital Embedded AR Classic 431-422… (CVSS 5.3)

Description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 4.0

6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.42%

35.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-125

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Siemens	Capital Embedded AR Classic 431-422	< *
Siemens	Capital Embedded AR Classic R20-11	< V2303
Siemens	Desigo PXC00-E.D	>= V2.3, < *
Siemens	Desigo PXC00-U	>= V2.3, < *
Siemens	Desigo PXC001-E.D	>= V2.3, < *
Siemens	Desigo PXC100-E.D	>= V2.3, < *
Siemens	Desigo PXC12-E.D	>= V2.3, < *
Siemens	Desigo PXC128-U	>= V2.3, < *
Siemens	Desigo PXC200-E.D	>= V2.3, < *
Siemens	Desigo PXC22-E.D	>= V2.3, < *
Siemens	Desigo PXC22.1-E.D	>= V2.3, < *
Siemens	Desigo PXC36.1-E.D	>= V2.3, < *
Siemens	Desigo PXC50-E.D	>= V2.3, < *
Siemens	Desigo PXC64-U	>= V2.3, < *
Siemens	Desigo PXM20-E	>= V2.3, < *

References

Timeline

Published: Oct 13, 2026
Last Modified: Oct 15, 2026
Status: Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-89208?

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

How severe is CVE-2026-89208?

CVE-2026-89208 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.42% probability of exploitation in the next 30 days.

How do I fix CVE-2026-89208?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →