Desigo Pxc200 E D
Monthly
Out-of-bounds memory reads in Siemens Desigo PXC building-automation controllers (all versions >= V2.3) and Capital Embedded AR Classic (431-422 all versions; R20-11 versions before V2303) allow an unauthenticated, remote attacker who can reach the device's packet-processing/communication service to read memory outside the intended packet boundaries by sending a malformed packet. Per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), the impact is limited to low confidentiality loss - no integrity or availability impact, and no code execution - because the flaw is a pure out-of-bounds read (CWE-125). There is no public exploit identified at time of analysis and no CISA KEV listing; the practical risk is governed by network exposure of these typically segmented OT/building-management interfaces.
Out-of-bounds memory reads in Siemens Desigo PXC building-automation controllers (all versions >= V2.3) and Capital Embedded AR Classic (431-422 all versions; R20-11 versions before V2303) allow an unauthenticated, remote attacker who can reach the device's packet-processing/communication service to read memory outside the intended packet boundaries by sending a malformed packet. Per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), the impact is limited to low confidentiality loss - no integrity or availability impact, and no code execution - because the flaw is a pure out-of-bounds read (CWE-125). There is no public exploit identified at time of analysis and no CISA KEV listing; the practical risk is governed by network exposure of these typically segmented OT/building-management interfaces.