CVE-2026-59693 in Desigo DXR2
Summary
by MITRE • 08/11/2026
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability affects multiple Siemens Desigo series building automation controllers including DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, and PXC7 models across their respective software versions. The issue represents a critical denial-of-service condition that specifically targets the BACnet communication protocol implementation within these industrial control systems. The vulnerability stems from inadequate input validation mechanisms within the BACnet packet processing component, allowing malicious actors to craft specially formatted packets that trigger unexpected behavior in the device's network stack.
The technical flaw manifests when the affected controllers receive malformed BACnet packets through their network interfaces, causing the device's communication services to become unresponsive or crash entirely. This occurs due to insufficient boundary checking and error handling within the BACnet protocol handler, which fails to properly sanitize incoming packet data before processing. The vulnerability aligns with CWE-129 Input Validation and CWE-704 Incorrect Type Conversion or Cast categories, as the system does not adequately validate packet structures or handle unexpected data formats. When exploited, the malformed packets cause the device to enter a non-functional state where it ceases to respond to legitimate BACnet queries, effectively disrupting building automation operations.
The operational impact of this vulnerability extends beyond simple service disruption, as these controllers are fundamental components in building management systems responsible for HVAC control, lighting management, security systems, and other critical infrastructure functions. A successful attack can lead to complete loss of building automation capabilities, potentially resulting in environmental control failures, security system degradation, or emergency response system malfunctions. The requirement for manual device reset or reboot creates additional operational challenges, particularly in large installations where multiple controllers may be affected simultaneously, leading to extended downtime and potential safety risks.
Organizations should immediately implement network segmentation strategies to isolate these devices from untrusted networks and apply firmware updates as provided by Siemens to address the vulnerability. Network monitoring solutions should be configured to detect unusual BACnet traffic patterns that might indicate exploitation attempts. The mitigation approach aligns with ATT&CK technique T1499.004 Network Denial of Service, where adversaries target network infrastructure to disrupt services. Additional protective measures include implementing secure BACnet communication protocols, deploying intrusion detection systems specifically configured for building automation networks, and establishing emergency procedures for rapid device recovery. Regular vulnerability assessments should be conducted on all industrial control system components to identify similar implementation weaknesses that could lead to cascading failures within critical infrastructure environments.