CVE-2026-59693 Overview
CVE-2026-59693 is a denial-of-service (DoS) vulnerability affecting multiple Siemens Desigo building automation controllers. An adjacent-network attacker can send a malformed Building Automation and Control Networks (BACnet) packet to cause the affected device to stop responding to BACnet queries. Recovery requires a manual device reset or reboot to restore normal operation. The flaw is tracked under CWE-754: Improper Check for Unusual or Exceptional Conditions and impacts the Desigo DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, and PXC7 product families. Siemens documented the issue in Siemens Security Advisory SSA-781903.
Critical Impact
A single malformed BACnet packet on the adjacent network halts BACnet communication on affected Desigo controllers, disrupting building automation operations until a physical reset or reboot is performed.
Affected Products
- Desigo DXR2 (all versions before V01.21.233.16-7862) and Desigo PXC3 (all versions before V01.21.233.16-7862)
- Desigo PXC4, PXC5.E003, and PXC5.E24 (all versions before V02.21.194.36-2715)
- Desigo PXC7 (all versions before V02.21.194.36-2715)
Discovery Timeline
- 2026-08-11 - CVE-2026-59693 published to the National Vulnerability Database (NVD)
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-59693
Vulnerability Analysis
The vulnerability resides in the BACnet protocol handling logic of Siemens Desigo controllers. BACnet is the primary communications protocol used in building automation for exchanging data between HVAC, lighting, access control, and energy management systems. The affected controllers fail to properly validate exceptional conditions when parsing incoming BACnet packets. When a malformed packet is processed, the BACnet service enters a non-recoverable state and ceases responding to further queries. Because the fault is limited to the BACnet stack, other device functions may continue running, but building automation systems that rely on BACnet communication lose visibility and control over the impacted controller.
Root Cause
The root cause is classified as CWE-754: Improper Check for Unusual or Exceptional Conditions. The device firmware does not adequately handle malformed or unexpected BACnet packet structures, leading to a service halt when such input is received. Because normal operation cannot resume automatically, only a hardware reset or reboot clears the fault state.
Attack Vector
Exploitation requires adjacent-network access, meaning the attacker must reside on the same BACnet segment or a logically connected network to reach the controller. Authentication is not required, and no user interaction is needed. A single crafted BACnet packet is sufficient to trigger the denial-of-service condition. See Siemens Security Advisory SSA-781903 for protocol-level details.
Detection Methods for CVE-2026-59693
Indicators of Compromise
- Desigo controllers becoming unresponsive to BACnet queries while remaining powered on
- Unexpected loss of BACnet telemetry from HVAC or building management systems
- Malformed BACnet/IP packets observed on UDP port 47808 (0xBAC0) targeting Desigo devices
Detection Strategies
- Deploy operational technology (OT)-aware network intrusion detection to inspect BACnet traffic for protocol anomalies and malformed Application Protocol Data Units (APDUs)
- Baseline normal BACnet communication patterns for each controller and alert on sudden cessation of responses from a specific device
- Correlate building management system (BMS) supervisor logs reporting communication timeouts with network capture data around the same timeframe
Monitoring Recommendations
- Continuously monitor availability of Desigo controllers using ICMP or BACnet Who-Is/I-Am polling from the supervisory system
- Log and retain full-packet captures on the BACnet network segment to support post-incident analysis when a controller becomes unresponsive
- Track physical resets or reboots of Desigo devices as high-signal indicators warranting investigation
How to Mitigate CVE-2026-59693
Immediate Actions Required
- Upgrade Desigo DXR2 and PXC3 firmware to V01.21.233.16-7862 or later
- Upgrade Desigo PXC4, PXC5.E003, PXC5.E24, and PXC7 firmware to V02.21.194.36-2715 or later
- Inventory all BACnet-connected controllers and validate firmware versions against the fixed builds listed in Siemens Security Advisory SSA-781903
Patch Information
Siemens has released fixed firmware versions for all affected Desigo product lines. Consult Siemens Security Advisory SSA-781903 for download locations and product-specific upgrade instructions.
Workarounds
- Restrict BACnet network access to trusted engineering workstations and supervisory controllers using VLAN segmentation and access control lists
- Isolate building automation networks from corporate IT networks and the internet in line with the ISA/IEC 62443 defense-in-depth guidance
- Enforce firewall rules that permit BACnet/IP (UDP 47808) only between authorized OT endpoints
# Example firewall rule restricting BACnet/IP to trusted supervisory hosts
iptables -A INPUT -p udp --dport 47808 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 47808 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
