Siemens Capital Embedded AR Classic Vulnerable to Out-of-Bounds Read
Siemens Capital Embedded AR Classic software contains an out-of-bounds read vulnerability that could lead to denial-of-service conditions.
Siemens has issued a security advisory detailing a critical vulnerability affecting its Capital Embedded AR Classic software. The flaw, identified as CVE-2026-89208, is an out-of-bounds read that could permit an unauthenticated remote attacker to disrupt product operations.
The vulnerability stems from the software's failure to properly validate input bounds before accessing packet data. This oversight allows an attacker to trigger memory reads that extend beyond the intended boundaries of the data packets being processed. Successful exploitation could result in abnormal product behavior, system instability, or a complete denial of service, rendering the affected industrial control systems inoperable.
Two specific versions of Siemens Capital Embedded AR Classic are impacted. The first is Capital Embedded AR Classic 431-422, across all its versions. The second is Capital Embedded AR Classic R20-11, specifically versions prior to V2303. The Common Vulnerability Scoring System (CVSS) v3.1 base score for this vulnerability is 5.3, categorized as MEDIUM severity, with a vector string indicating it is network-exploitable with no privileges or user interaction required.
Siemens has provided specific remediation guidance for the affected products. For Capital Embedded AR Classic R20-11, the recommended fix is to update to version V2303 or a later release. For Capital Embedded AR Classic 431-422, no fix is currently planned. In cases where a direct fix is not available, Siemens recommends implementing network segmentation and configuring firewalls to restrict access to the affected devices.
These recommendations align with broader cybersecurity best practices for industrial control systems (ICS). CISA emphasizes minimizing network exposure, isolating control system networks from business networks, and utilizing secure remote access methods like VPNs. Organizations are urged to conduct thorough impact and risk assessments before deploying any defensive measures.
The vulnerability affects critical infrastructure sectors worldwide, including Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities. The broad applicability across these vital sectors underscores the importance of timely patching and robust mitigation strategies.
Siemens ProductCERT initially reported this vulnerability to CISA. The advisory serves as a republication of Siemens' own Common Security Advisory Framework (CSAF) advisory, SSA-055299, aimed at increasing visibility and awareness among users of these industrial control systems. Users are encouraged to consult Siemens' operational guidelines for Industrial Security for further best practices.