Anyone running Siemens Capital Embedded AR Classic R20-11 should update to V2303 or later. Anyone on version 431-422 has no patch to install, because Siemens said it does not plan to issue one.
The flaw, tracked as CVE-2026-89208, is an out-of-bounds read: the software fails to check input bounds before accessing packet data, so it can be tricked into reading memory outside the intended packet. According to the advisory, an unauthenticated attacker could trigger it remotely, causing abnormal behavior, instability or denial of service. Every 431-422 release is affected, as is R20-11 below V2303. Siemens ProductCERT, the company's security team, reported the bug and published its advisory on October 13. The US government republished it on October 22.
For both versions, Siemens recommends network segmentation and placing ECUs (electronic control units, the small embedded computers inside larger systems) behind properly configured gateways or firewalls. For 431-422, that is the entire remedy.
The score is 5.3 out of 10, rated medium. The vector behind it requires no login and no user interaction, but it rates the impact as limited confidentiality exposure only, with none for availability. That sits oddly beside the advisory's own warning about denial of service. Our reading is that the number may understate the risk for equipment that has to keep running, though the advisory does not say how likely a crash is in practice.
The affected sectors listed are broad: critical manufacturing, transportation, energy, healthcare, financial services and government facilities. The advisory does not say how many devices run 431-422, so the size of the group left without a fix is unknown. Those operators now depend on firewalls and gateways to do the work a patch would have done.