Siemens Capital Embedded AR Classic

MonitorCVSS 5.3ICS-CERT ICSA-26-295-04Oct 13, 2026

Siemens

Attack path

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

What this means

What could happen

Could allow an attacker to read sensitive memory contents

Who's at risk

Organizations in critical infrastructure using Siemens equipment

How it could be exploited

Attacker on the corporate network or internet could reach this device without any credentials. The attack is straightforward with no special conditions

Exploitability

Unlikely to be exploited — EPSS score 0.4%

Affected products (2)

1 with fix1 EOL

ProductAffected VersionsFix Status

Capital Embedded AR Classic 431-422All versionsNo fix (EOL)

Capital Embedded AR Classic R20-11 < V2303< 23032303

Remediation & Mitigation

0/3

Do now — compensating controls

0/1

WORKAROUNDApply network segmentation and put the ECUs behind properly configured gateways/firewalls

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

UPGRADEUpdate to V2303 or later version

Mitigations - no patch available

0/1

Capital Embedded AR Classic 431-422 has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:

HARDENINGCurrently no fix is planned

CVEs (1)

CVE-2026-89208

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/901a5bde-134c-4d74-bffa-ebcb33d62a74

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.