All vulnerabilities
CVE-2026-89208

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PX

Siemens Capital Embedded AR Classic 431-422
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 2

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Text from CVE List

Affected versions 15

  • Capital Embedded AR Classic 431-422affected: and laterCVE List
  • Capital Embedded AR Classic R20-11affected: all versions before V2303CVE List
  • Desigo PXC00-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC00-Uaffected: V2.3 and laterCVE List
  • Desigo PXC001-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC100-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC12-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC128-Uaffected: V2.3 and laterCVE List
  • Desigo PXC200-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC22-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC22.1-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC36.1-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC50-E.Daffected: V2.3 and laterCVE List
  • Desigo PXC64-Uaffected: V2.3 and laterCVE List
  • Desigo PXM20-Eaffected: V2.3 and laterCVE List

References 2