Siemens Capital Embedded AR Classic: 1 CVE, Medium 5.3
Summary
CISA reports 1 vulnerability in Siemens Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11. Weakness type: Out-of-bounds Read. The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Highest CVSS v3 score: 5.3 (Medium), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11
- CVEs
- CVE-2026-89208
- Highest CVSS v3
- 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-89208 | Out-of-bounds Read | 5.3 | – | No | CVE-2026-89208 |
Affected products (2)
- Capital Embedded AR Classic 431-422
- Capital Embedded AR Classic R20-11 < V2303
Vendor fixes and mitigations (from advisory)
- Mitigation: Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
- No Fix Planned: Currently no fix is planned
- Vendor Fix: Update to V2303 or later version
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-295-04
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-055299.json
- https://cert-portal.siemens.com/productcert/html/ssa-055299.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.