EUVD-2026-56121
GHSA-m7fp-mx3h-5426
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A confirmed by BACnet adjacency requirement; A:H over vendor's A:L because the device fully stops responding and requires manual reboot, satisfying the persistent total-loss-of-availability criterion.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.
AnalysisAI
Denial-of-service in Siemens Desigo building automation controllers (DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, PXC7) allows an unauthenticated adjacent-network attacker to permanently halt BACnet communication on the device by sending a single malformed BACnet packet. The device stops responding to all BACnet queries and requires a manual reset or reboot to recover, making this operationally disruptive in building management environments where HVAC, access control, or other OT functions may depend on continuous BACnet availability. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The affected devices - Desigo DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, and PXC7 - are Siemens programmable building automation controllers used in HVAC, lighting, and facility management systems. They communicate using BACnet (Building Automation and Control Networks), a standard OT protocol that typically operates over IP on local or segmented facility networks. The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions): the BACnet protocol parser fails to gracefully handle malformed or unexpected packet structures, leading to a fatal error state in the BACnet service stack. Rather than discarding the malformed input and continuing operation, the device enters a non-responsive state that persists until power-cycled or rebooted. CPE data confirms six distinct Siemens Desigo product lines are affected across two firmware version branches (V01.x for DXR2/PXC3 and V02.x for PXC4/PXC5.E003/PXC5.E24/PXC7).
RemediationAI
Vendor-released patch: V01.21.233.16-7862 for Desigo DXR2 and PXC3; V02.21.194.36-2715 for Desigo PXC4, PXC5.E003, PXC5.E24, and PXC7. Organizations should prioritize upgrading to these firmware versions per the Siemens ProductCERT advisory at https://cert-portal.siemens.com/productcert/html/ssa-781903.html. Where immediate patching is not possible, the most effective compensating control is network segmentation: restrict BACnet (UDP port 47808) access to only authorized engineering workstations and BACnet routers using firewall ACLs or OT-aware network monitoring. Blocking all external or untrusted sources from reaching BACnet endpoints eliminates the AV:A attack path. A trade-off of this control is that legitimate cross-segment BACnet traffic (e.g., from a central BMS server) must be explicitly allowed, requiring accurate network mapping. Physical access controls to facility network ports where BACnet devices are connected provide an additional layer of defense-in-depth with minimal operational impact.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today