CVE-2026-89208: Capital Embedded AR Classic 431-422 0 to before *; +14 more affected products

Affected technology

Capital Embedded AR Classic 431-422 · 0 to before *
Siemens

Capital Embedded AR Classic R20-11 · 0 to before V2303
Siemens

Desigo PXC00-E.D · V2.3 to before *
Siemens

Desigo PXC00-U · V2.3 to before *
Siemens

Desigo PXC001-E.D · V2.3 to before *
Siemens

Desigo PXC100-E.D · V2.3 to before *
Siemens

Desigo PXC12-E.D · V2.3 to before *
Siemens

Desigo PXC128-U · V2.3 to before *
Siemens

Desigo PXC200-E.D · V2.3 to before *
Siemens

Desigo PXC22-E.D · V2.3 to before *
Siemens

Desigo PXC22.1-E.D · V2.3 to before *
Siemens

Desigo PXC36.1-E.D · V2.3 to before *
Siemens

Desigo PXC50-E.D · V2.3 to before *
Siemens

Desigo PXC64-U · V2.3 to before *
Siemens

Desigo PXM20-E · V2.3 to before *
Siemens

Description’s affected range: versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker could trigger memory reads outside the intended packet boundaries. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as low; integrity and availability impact as none.