Siemens Desigo PXC CVE-2026-89208

No authentication and no user interaction are required (PR:N/UI:N), but exploitation requires network-level access to the affected device's packet-processing/communication service - these are Siemens Desigo PXC BACnet/building-automation controllers and Capital Embedded AR Classic (AUTOSAR) components typically deployed on segmented OT/building-management networks rather than internet-facing. The specific trigger is a malformed packet whose bounds are not validated before the packet data is accessed. Limiting factors: impact is confined to out-of-bounds memory READ with low confidentiality impact only (C:L, I:N, A:N) - no code execution, data modification, or denial of service - and reachability depends on network exposure of the device's protocol interface, which network segmentation of control systems normally restricts.

This is a moderate-severity out-of-bounds read (CWE-125) in Siemens Desigo PXC building-automation controllers and Capital Embedded AR Classic software. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) is internally consistent with the description: a remote, unauthenticated attacker can trigger reads past packet boundaries, yielding only a low-confidentiality impact with no integrity or availability effect. All exploitation signals point AWAY from urgent priority: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at the time of analysis. The low confidentiality-only impact means this is an information-disclosure/memory-leak primitive, not a code-execution or crash bug, which is why the score sits at Medium despite being network-reachable and unauthenticated. The realistic risk is therefore lower than the 'unauthenticated + network' framing suggests: it is most valuable as a reconnaissance or chaining primitive (e.g., leaking memory to defeat ASLR or expose secrets) rather than a standalone high-impact flaw. Key missing data: no EPSS, no SSVC decision record, no POC, and no vendor-stated automatable/technical-impact classification were supplied - these should be retrieved from the two Siemens ProductCERT advisories (SSA-055299, SSA-333035) to refine prioritization.

An attacker with network reachability to an exposed Desigo PXC controller or an AR Classic communication stack sends a crafted protocol packet whose length/offset fields exceed the actual buffer. Because input bounds are not validated before the packet data is accessed, the device reads adjacent memory and may return it in a response, leaking fragments of process memory. No public exploit code is referenced, so an attacker would need to develop the packet themselves; the low complexity (AC:L) and lack of authentication (PR:N) make this straightforward once protocol access is obtained.