CVE-2026-59693
View CSAF Summary A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Desigo DXR and PXC Controllers are affected: Desigo DXR2 vers:intdot/<01.21.233.16-7862 (CVE-2026-59693) Desigo PXC3 vers:intdot/<01.21.233.16-7862 (CVE-2026-59693) Desigo PXC4 vers:intdot/<02.21.194.36-2715 (CVE-2026-59693) Desigo PXC5.E003 vers:intdot/<02.21.194.36-2715 (CVE-2026-59693) Desigo PXC5.E24 vers:intdot/<02.21.194.36-2715 (CVE-2026-59693) Desigo PXC7 vers:intdot/<02.21.194.36-2715 (CVE-2026-59693) CVSS Vendor Equipment Vulnerabilities v3 4.3 Siemens Siemens Desigo DXR and PXC Controllers Improper Check for Unusual or Exceptional Conditions Background Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-59693 The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality. View CVE Details Affected Products Siemens Desigo DXR and PXC Controllers Vendor: Siemens Product Version: Desigo DXR2 < V01.21.233.16-7862, Desigo PXC3 < V01.21.233.16-7862, Desigo PXC4 < V02.21.194.36-2715, Desigo PXC5.E003 < V02.21.194.36-2715, Desigo PXC5.E24 < V02.21.194.36-2715, Desigo PXC7 < V02.21.194.36-2715 Product Status: known_affected Remediations Vendor fix Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for addition
CSIRTS triage
- What
- BACnet packet processing vulnerability allows denial of service when receiving malformed packets, requiring device reset to restore functionality.
- Who is affected
- Multiple Siemens Desigo DXR and PXC controller models in critical building and infrastructure control systems worldwide.
- Urgency
- Important; CVSS 4.3 denial of service but affects critical infrastructure control; patches available.
- Action
- Update Desigo DXR2, PXC3, PXC4, PXC5 models, and PXC7 to patched versions per Siemens advisory.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-59693
Get an email if CVE-2026-59693 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Advisory coverage (4)
- criticalSiemens Desigo DXR and PXC Controllerscisa · 2026-08-13
- unknownMultiple vulnerabilities in Siemens products (August 12, 2026)cert-fr-avis · 2026-08-12
- mediumCVE-2026-59693: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo…nvd · 2026-08-11
- unknownNCSC-2026-0282 [1.00] [M/H] Vulnerabilities fixed in Siemens productsncsc-nl · 2026-08-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-59693)