CISA advisory: BACnet DoS hits Siemens Desigo controllers
The CVSS 4.3 masks a physical-reboot recovery requirement, and this is the second BACnet-parsing DoS in the Desigo line in five years.
TL;DR
CISA published ICSA-26-225-08 for CVE-2026-59693, a denial-of-service flaw in Siemens Desigo DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, and PXC7 building automation controllers. An unauthenticated attacker on the local network can send a malformed BACnet packet that freezes the device until physically rebooted. Siemens has released patched firmware, V01.21.233.16-7862 for DXR2 and PXC3, V02.21.194.36-2715 for the PXC4, PXC5 variants, and PXC7. The CVSS 3.1 score sits at 4.3 (medium), constrained by the adjacent-network attack vector. This is the second BACnet-parsing DoS to hit the Desigo line in five years; CVE-2021-41545 could trigger a factory reset through the same class of malformed-packet attack.
The vulnerability is straightforward: a malformed BACnet packet triggers an improper-check condition that stops the controller from responding to BACnet queries. Recovery isn't graceful, someone has to physically reset or reboot the device. No authentication is required, but the attacker needs to be on the local network segment, which is what keeps the CVSS score at 4.3.
For building operators running these controllers in commercial facilities, hospitals, or manufacturing floors, the practical risk depends on network segmentation. If the BACnet subnet is isolated from untrusted traffic, as Siemens' own operational guidelines recommend, the attack surface shrinks to insiders and compromised adjacent hosts. If the building controls share a flat network with general-purpose endpoints, a single malformed packet from any compromised machine on that segment could silence the HVAC controller.
This is the second BACnet-specific DoS in the Desigo family since 2021. CVE-2021-41545, patched in early 2022, let a malformed BACnet packet push controllers into an "out of work" state that could escalate to a factory reset. Different CWE, same protocol, same outcome class. BACnet's simplicity is its deployment virtue, and that simplicity means the parsing surface is small and the failure modes tend to be binary: the device works or it doesn't. Siemens ships patches quickly and the CVSS scores stay medium, but the recurrence suggests the protocol stack hasn't been systematically hardened against malformed input across the product line.
Published ·Deep Fathom