| Publication Date: |
|
| Last Update: |
|
| Current Version: | V1.0 |
| CVSS v3.1 Base Score: | 6.5 |
| CVSS v4.0 Base Score: | 6.9 |
| Affected Product and Versions | Remediation |
|---|---|
|
All versions < V3.94 affected by CVE-2026-89207 |
Update to V3.94 or later version
|
|
All versions < V4.17 affected by CVE-2026-89207 |
Update to V4.17 or later version
|
Product-specific remediations or mitigations can be found in the section
Known Affected Products.
Please follow the General Security Recommendations.
As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.
This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.
Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).
| CVSS v3.1 Base Score | 6.5 |
| CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| CVSS v4.0 Base Score | 6.9 |
| CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N |
| CWE | CWE-1287: Improper Validation of Specified Type of Input |
| V1.0 (2026-09-16): | Publication Date |