Siemens ICS Products Vulnerable to DoS, Availability Attacks
CISA has issued an advisory detailing multiple vulnerabilities in Siemens APOGEE, TALON, and Desigo PXC/PXM industrial control system products, potentially leading to denial-of-service conditions.
CISA has alerted organizations to a series of vulnerabilities affecting Siemens' APOGEE, TALON, and Desigo PXC/PXM product lines. These security flaws, detailed in advisory ICSA-26-295-08, could be exploited by attackers to cause denial-of-service (DoS) conditions, thereby impacting the availability of critical industrial control systems.
The vulnerabilities span several product families and versions. Notably, CVE-2026-89208, an out-of-bounds read vulnerability, affects Desigo PXC devices running version 2.3 or later. This specific flaw allows an unauthenticated remote attacker to trigger memory reads outside intended packet boundaries by exploiting improper input validation.
In addition to the Desigo PXC vulnerability, a cluster of related flaws (CVEs 2026-102073 through 2026-102076) impact various APOGEE and TALON products. These vulnerabilities include stack-based buffer overflows and integer underflows, which can also contribute to denial-of-service scenarios and compromise device availability.
Siemens has acknowledged these issues and is actively working on remediation. For many affected products, the company has released updated versions and strongly recommends that users upgrade to the latest available software. The advisory lists specific version numbers for APOGEE MBC, MEC, PXC Compact, PXC Modular, and TALON TC devices that are vulnerable.
For products where fixes are not yet available or are not planned, Siemens has provided specific mitigation strategies. These recommendations primarily focus on network segmentation, advising users to place affected controllers behind properly configured gateways or firewalls to limit potential attack vectors. For CVE-2026-89208 affecting Desigo PXC devices, network segmentation is the primary mitigation, as no fix is currently planned.
The affected Siemens products are deployed globally across critical infrastructure sectors, including Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services. The widespread use of these industrial control systems underscores the potential impact of these vulnerabilities.
While the vulnerabilities primarily lead to denial-of-service and availability issues, the disruption of these systems could have cascading effects on industrial operations. Organizations relying on these Siemens products are urged to review the CISA advisory thoroughly, assess their exposure, and implement the recommended patches and mitigations promptly to protect their operational integrity.