CISA 2026-10-22

Siemens Capital Embedded AR Classic

CVE-2026-89208 +1

Machine-generated analysis · WAYSCloud LLM

An out-of-bounds read (CVE-2026-89208) affects Siemens Capital Embedded AR Classic 431-422 (all versions) and R20-11 versions earlier than V2303.

Context

The advisory concerns Siemens Capital Embedded AR Classic 431-422 and the R20-11 variant. It reports an out-of-bounds read that could let an unauthenticated remote attacker read memory beyond packet boundaries, leading to instability or denial-of-service. Siemens has issued a V2303 (or later) update for R20-11 and recommends applying it, while no fix is currently planned for the 431-422 line.

Operator considerations

Check: Verify which Capital Embedded AR Classic versions are deployed and whether they fall within the affected ranges.
Isolate: Segment ECUs and place them behind properly configured gateways or firewalls.
Patch: Update R20-11 devices to V2303 or later as advised.

From Cybersecurity and Infrastructure Security Agency ↗

The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens Capital Embedded AR Classic are affected:

Capital Embedded AR Classic 431-422 vers:all/* (CVE-2026-89208)

Capital Embedded AR Classic R20-11 vers:intdot/

Read the full advisory on CISA →