CISA republished a Siemens advisory on an AUTOSAR stack with no fix planned
The US cyber agency entered into its industrial advisory register an unauthenticated remote out-of-bounds read in Siemens' AUTOSAR Classic basic software for vehicle control units, nine days after Siemens disclosed it.
The Cybersecurity and Infrastructure Security Agency published advisory ICSA-26-295-04 on October 22, carrying a Siemens disclosure about its Capital Embedded AR Classic software.
Siemens had published the same advisory, SSA-055299, on October 13. Both records carry a revision history, which names the October 22 entry as the initial republication of the Siemens document.
The flaw, CVE-2026-89208, is an out-of-bounds read. The advisory said the affected product does not properly validate input bounds before accessing packet data, which could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries. Siemens scored it 5.3 on CVSS v3.1 and 6.9 on CVSS v4.0.
Two product lines are affected. For Capital Embedded AR Classic R20-11 below V2303, the advisory gave the fix as an update to V2303 or later. For Capital Embedded AR Classic 431-422, across all versions, it said no fix is currently planned. The mitigation given for both is network segmentation, with the control units placed behind properly configured gateways or firewalls.
Siemens describes Capital Embedded AR Classic, formerly called Capital VSTAR, as a scalable AUTOSAR Classic software platform that meets ISO 26262 use cases for up to ASIL D, with versions for several recent AUTOSAR Classic releases including 4.3.1 and 20-11. It said the product includes the Nucleus NET networking module although it is not based on Nucleus RTOS. CISA listed transportation systems among the affected critical infrastructure sectors and the deployment as worldwide.
Source: Cybersecurity and Infrastructure Security Agency · First reported by Siemens ProductCERT