Siemens Desigo DXR and PXC Controllers BACnet Denial-of-Service Vulnerability

Technical Analysis

CVE-2026-59693 is an Improper Check for Unusual or Exceptional Conditions (CWE-754) flaw in Siemens Desigo DXR and PXC controllers, exploitable via crafted malformed BACnet protocol packets sent over an adjacent network (AV:A), requiring no privileges or user interaction. Successful exploitation causes a denial-of-service condition affecting availability only (no confidentiality or integrity impact), with recovery requiring a physical device reset or reboot. The CVSS 3.1 base score is 4.3 (Medium), reflecting the local network attack vector and limited-severity impact scope, though in operational technology environments even brief outages of HVAC/building control systems can disrupt facility operations. This is a building automation/OT vulnerability with no direct exploitation path into IT networks or AI agent infrastructure; however, if AI-driven building management or facility monitoring agents rely on BACnet data from these controllers for decision-making, a DoS condition could disrupt agent telemetry and automated control loops, indirectly affecting agent-driven operations.

Affected Systems

Siemens Desigo DXR2 (versions < V01.21.233.16-7862), Desigo PXC3 (< V01.21.233.16-7862), Desigo PXC4 (< V02.21.194.36-2715), Desigo PXC5.E003 (< V02.21.194.36-2715), Desigo PXC5.E24 (< V02.21.194.36-2715), Desigo PXC7 (< V02.21.194.36-2715)

Indicators of Compromise

• No specific IOCs published; exploitation involves malformed BACnet protocol packets sent to affected devices over the local network

Remediation Steps

1. 1

   Apply vendor firmware update

   Update Desigo DXR2 and PXC3 controllers to V01.21.233.16-7862 or later, and Desigo PXC4, PXC5.E003, PXC5.E24, and PXC7 to V02.21.194.36-2715 or later via Siemens ProductCERT or local Siemens support.

2. 2

   Restrict network access

   Isolate BACnet/building automation networks from business and internet-facing networks using firewalls and network segmentation to prevent unauthorized access to controllers.

3. 3

   Limit remote access

   Where remote access is required, use VPNs with up-to-date patching, recognizing that VPN security depends on the security of connected endpoints.

4. 4

   Implement recovery procedures

   Establish operational procedures for rapid device reset/reboot in case of DoS exploitation to minimize downtime of building control functions.

5. 5

   Monitor for anomalous BACnet traffic

   Deploy network monitoring to detect malformed or unusual BACnet packets targeting Desigo controllers.