IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic

MEDIUM
CVSS 5.3
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2026-89208 5.3 medium
CVE-2026-89208. The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

// Remediations (3)

Mitigation:  CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configure
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
Patch: Update to V2303 or later version
Update to V2303 or later version
Mitigation: Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

// References