Siemens Desigo DXR and PXC Controllers: 1 CVE, Medium 4.3
Summary
CISA reports 1 vulnerability in Siemens Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5.E003 and 2 more. Weakness type: Improper Check for Unusual or Exceptional Conditions. A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Highest CVSS v3 score: 4.3 (Medium), exploitable from an adjacent network.
At a glance
- Vendor
- Siemens
- Products
- Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5.E003, Desigo PXC5.E24, Desigo PXC7
- CVEs
- CVE-2026-59693
- Highest CVSS v3
- 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-59693 | Improper Check for Unusual or Exceptional Conditions | 4.3 | – | No | CVE-2026-59693 |
Affected products (6)
- Desigo DXR2 < V01.21.233.16-7862
- Desigo PXC3 < V01.21.233.16-7862
- Desigo PXC4 < V02.21.194.36-2715
- Desigo PXC5.E003 < V02.21.194.36-2715
- Desigo PXC5.E24 < V02.21.194.36-2715
- Desigo PXC7 < V02.21.194.36-2715
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for additional support in obtaining the update.
- Vendor Fix: Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-225-08
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-781903.json
- https://cert-portal.siemens.com/productcert/html/ssa-781903.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.