Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Siemens Capital Embedded AR Classic has remote out-of-bounds read

Original title: Siemens Capital Embedded AR Classic

CISA Advisoriesby CISA ()3 min read1
Read at cisa.gov
Part of a story covered by 3 sourcesCISA republishes Siemens CVE-2026-89208 advisories; some products unfixedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

R20-11 is fixed in V2303, while all 431-422 builds have no planned fix and should stay behind firewalls.

CISA republished Siemens ProductCERT SSA-055299 on Capital Embedded AR Classic. CVE-2026-89208 is an out-of-bounds read: the product does not validate input bounds before accessing packet data, so an unauthenticated remote attacker can read memory outside the packet. Siemens says this can cause abnormal behavior, instability, or denial of service. R20-11 before V2303 should be updated; no fix is planned for 431-422.

Key facts
  • CVSS 3.1 base score is 5.3 (medium), with low confidentiality impact.
  • Capital Embedded AR Classic 431-422, all versions, is known affected.
  • R20-11 before V2303 is fixed in V2303 or later.
  • Siemens advises network segmentation and placing ECUs behind gateways or firewalls.
  • The weakness is CWE-125.
Security assessment · AI, from the article

Impact: Remote out-of-bounds memory read, with possible instability or denial of service

ProductAffectedFixed in
Siemens Capital Embedded AR Classic 431-422all versions—
Siemens Capital Embedded AR Classic R20-11< V2303V2303 or later
What to do
  1. 1.Update Capital Embedded AR Classic R20-11 to V2303 or later.
  2. 2.Segment networks and place ECUs behind configured gateways or firewalls.
Analyze CVE-2026-89208 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-89208
ATT&CK
T1190 Exploit Public-Facing Application
Tags
siemensicsembeddedout-of-bounds-readecu
Vendors
Siemens
Products
Capital Embedded AR Classic
Organizations
CISASiemens ProductCERT

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-89208
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo…
6.9—

From the original article

3 min read at cisa.gov

View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.