Desigo Pxc5 E24
Monthly
Denial-of-service in Siemens Desigo building automation controllers (DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, PXC7) allows an unauthenticated adjacent-network attacker to permanently halt BACnet communication on the device by sending a single malformed BACnet packet. The device stops responding to all BACnet queries and requires a manual reset or reboot to recover, making this operationally disruptive in building management environments where HVAC, access control, or other OT functions may depend on continuous BACnet availability. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial-of-service in Siemens Desigo building automation controllers (DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, PXC7) allows an unauthenticated adjacent-network attacker to permanently halt BACnet communication on the device by sending a single malformed BACnet packet. The device stops responding to all BACnet queries and requires a manual reset or reboot to recover, making this operationally disruptive in building management environments where HVAC, access control, or other OT functions may depend on continuous BACnet availability. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.