CISA republishes Siemens advisory on DoS flaw in Desigo controllers
CISA republished a Siemens advisory on a denial-of-service vulnerability in Desigo DXR and PXC controllers that malformed BACnet packets can trigger.
CISA on Aug. 13 republished a Siemens advisory about a denial-of-service vulnerability in Desigo DXR and PXC controllers that malformed BACnet packets can trigger.
CISA says affected devices may stop responding to BACnet queries, which can disrupt building and industrial control functions until the unit is reset or rebooted. The agency lists the flaw as CVE-2026-59693 and rates it CVSS v3.1 4.3, or medium.
The issue affects several Siemens product families, including Desigo DXR2 and Desigo PXC3 below V01.21.233.16-7862, and Desigo PXC4, PXC5.E003, PXC5.E24 and PXC7 below V02.21.194.36-2715. The advisory identifies the weakness as CWE-754, or improper check for unusual or exceptional conditions.
CISA says the equipment is deployed worldwide and used in commercial facilities, critical manufacturing, energy, healthcare and public health, and transportation systems.
Siemens released new versions to address the issue. Siemens recommends updating to V01.21.233.16-7862 or later for some affected devices, and to V02.21.194.36-2715 or later for others.
The advisory says Thomas EBI of Sauter reported the vulnerability to Siemens. CISA also repeats standard guidance for control systems, including reducing network exposure, placing systems behind firewalls, isolating them from business networks, and using updated VPNs for remote access.
The page is marked as an initial CISA republication of Siemens SSA-781903, with an initial release date of Aug. 11 and a CISA republication date of Aug. 13.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.