CVE-2026-59693

Executive Summary

CVE-2026-59693 is a denial-of-service (DoS) vulnerability affecting Siemens Desigo building automation controllers in the DXR2, PXC3, PXC4, PXC5, and PXC7 product families. A network-adjacent attacker can send a malformed BACnet packet to the affected device, causing it to stop responding to BACnet queries; normal functionality is only restored after a device reset or reboot. No patch is confirmed from any tracked source, no public exploit code is known, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability falls under CWE-754 — Improper Check for Unusual or Exceptional Conditions. This weakness class indicates that the affected firmware's BACnet protocol handler does not adequately validate or anticipate exceptional inputs before processing them. When the protocol stack receives a packet that violates expected BACnet encoding rules (for example, structurally inconsistent framing, invalid length fields, or unexpected APDU/BVLC contents), the parser enters an unhandled state. Because the failure causes the whole device to "stop responding to BACnet queries" and requires a reset or reboot to recover, the malformed input likely triggers an unhandled exception or watchdog-level failure within the BACnet application task rather than being gracefully discarded.

Key characteristics derived from the advisory data:

• Attack surface: The CVSS vector AV:A (Adjacent) confirms the attacker must be positioned on the same network segment as the device — typically the building automation / OT network. No authentication (PR:N) and no user interaction (UI:N) are required.
• Protocol: BACnet (Building Automation and Control Networks), the ASHRAE-standard protocol used heavily in HVAC and building management systems. BACnet/IP traffic conventionally operates over UDP port 47808. The description itself does not specify the exact malformed field or frame type; that information is not present in public NVD/CNA data.
• Failure mode: The device stops responding to BACnet queries entirely. This is more severe than a dropped packet — it implies the BACnet service (or the controller's main processing loop) has crashed or hung, hence the need for a power cycle.
• Affected firmware trains: Two distinct version lines are listed, indicating the flaw persists across a broad hardware/firmware portfolio: the V01.21.x train (DXR2, PXC3) and the V02.21.x train (PXC4, PXC5.E003, PXC5.E24, PXC7). No CNA title was provided in the data, and the NVD description does not disclose the specific packet bytes that trigger failure; therefore, the exact malformed structure cannot be reconstructed from public information.

The availability impact is rated low (A:L) in the CVSS vector, and there is no confidentiality or integrity impact (C:N / I:N). The base score of 4.3 reflects the combination of low complexity, no privilege requirement, and the access adjacency requirement.

Exploitation Scenarios

There is no public PoC, no Nuclei template, and no exploit code identified for this CVE. The attack chain below is inferred from the vulnerability class (network-adjacent packet-triggered DoS) and the NVD description.

1. Reconnaissance / target identification: An attacker on the building automation network (or a remote attacker who has gained foothold in the OT segment) performs discovery for BACnet/IP-enabled devices. BACnet devices respond to standard Who-Is broadcast queries, and services are commonly found on UDP 47808. Internet-exposed building controllers can also be pre-filtered using platform dorks (e.g., port:47808 BACnet). Siemens Desigo controllers present BACnet vendor identification, allowing the attacker to confirm the vendor and narrow down potentially affected models.

2. Triggering the flaw: The attacker crafts a BACnet packet that is structurally inconsistent at the BACnet/IP or APDU layer — for example, a packet whose declared lengths do not match the actual payload, or whose APDU type/parameter encoding violates the BACnet standard. Because the target's firmware fails to properly check for these unusual conditions (CWE-754), the malformed input is accepted into the parsing path rather than rejected at the boundary.

3. Payload / execution method: The packet is transmitted to the target's BACnet endpoint (typically UDP 47808). No authentication or session establishment is required — a single malformed datagram can be sufficient to hit the unhandled condition. Since no specific byte-level signature is documented publicly, reliable detection relies on protocol anomaly heuristics (packet length anomalies, BVLC length fields with impossible values, or abnormal volume to a single BACnet endpoint).

4. Post-exploitation impact: After the malformed packet is processed, the controller ceases to respond to BACnet queries. Supervisory systems, BMS front-ends, and alarm handling lose visibility and control of the affected device. The device remains in this state until manually reset or rebooted — no automatic recovery is described. The attacker can repeat the process against multiple controllers, or re-trigger the failure immediately after recovery, effectively sustaining a long-term availability outage on the building automation segment.

Impact Assessment

Business impact: Desigo DXR2/PXC3/PXC4/PXC5/PXC7 controllers are used in commercial building automation — HVAC control, lighting, room control, and central plant/BMS integration. A DoS on these devices degrades facility operations: loss of setpoint control, loss of alarm and telemetry visibility, and potential disruption to environmental conditions in sensitive facilities (e.g., data centers, laboratories, healthcare). The NVD description limits the impact to loss of BACnet query responsiveness, so there is no evidence of data theft, command injection, or physical damage; the danger lies in sustained operational blindness.

Affected systems / blast radius: Six controller families across two firmware trains are affected, representing a broad installed base in commercial buildings. The attack is one-target-per-packet, but an attacker can trivially script packet bursts against the entire BACnet subnet, causing simultaneous outages across many controllers. The AV:A (Adjacent) requirement is a meaningful constraint — exploitation requires network adjacency, which in properly segmented facilities means prior compromise of the OT/BAS network. However, flat networks or VPN-enabling remote access to BAS segments would expand the practical blast radius.

CVSS context: Base score 4.3 (Medium-low). Sub-scores: Attack Complexity Low, Privileges Required None, User Interaction None, Availability Impact Low, Confidentiality/Integrity Impact None. EPSS score of 0.00163 places this CVE in a low percentile band, indicating low immediate likelihood of exploitation in the wild. It is not in CISA KEV, and no known threat actor campaigns reference this CVE at the time of writing.

Detection Guidance

Because the precise malformed packet structure is not documented, all rules below use protocol-anomaly and volumetric heuristics around BACnet/IP (UDP 47808) rather than a byte-level signature. Tune thresholds to your environment's normal BACnet traffic baseline.

Sigma Rule

title: Potential Siemens Desigo BACnet Denial-of-Service Attempt (CVE-2026-59693)
id: 8f4b1c3e-1e5a-4f2b-9c3d-6a7b8c9d0e1f
status: experimental
description: >
  Detects BACnet/IP (UDP 47808) traffic that is abnormally short or arriving in
  high volume toward a single destination, consistent with a malformed-packet
  DoS attempt against Siemens Desigo controllers (CVE-2026-59693).
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    destination.port: 47808
    protocol.name: udp
  anomaly_short_packet:
    network.transport.packet_size: < 4
  anomaly_volume:
    network.udp.packets: >= 50
  condition: selection and (anomaly_short_packet or anomaly_volume)
fields:
  - source.ip
  - destination.ip
  - destination.port
  - network.transport.packet_size
falsepositives:
  - Legitimate BACnet commissioning and discovery broadcasts
  - BACnet router keepalives and Who-Is/ I-Am exchanges
level: medium
tags:
  - attack.t1499
  - cve.2026-59693
  - cwe.754

YARA Rule

rule SUSP_BACnet_Malformed_Packet_CVE_2026_59693
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects PCAP captures containing BACnet/IP frames with "
                      "structurally invalid BVLC headers consistent with "
                      "malformed-packet DoS against Siemens Desigo controllers (CVE-2026-59693)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59693"
        cve = "CVE-2026-59693"
        date = "2026-01-01"

    strings:
        // BACnet/IP (UDP) BVLC header: type 0x81 0x0A, followed by 2-byte length field.
        // A length value of 0x0000 is invalid — minimum valid BVLC length is 4 bytes.
        $bvlc_bad_len_zero  = { 81 0A 00 00 }
        $bvlc_len_lt_4      = { 81 0A 00 [01] }  // length high byte 0x00, low byte < 0x04
        $bvlc_any           = { 81 0A }

    condition:
        uint16(0) == 0x0A81 and
        ( $bvlc_bad_len_zero or $bvlc_len_lt_4 or $bvlc_any )
}

Suricata IDS Rule

# Alert on BACnet/IP frames with an invalid (zero) BVLC length — an
# immediate indicator of a structurally malformed packet.
alert udp any any -> any 47808 (msg:"CVE-2026-59693 Siemens Desigo BACnet malformed packet (zero BVLC length) DoS attempt"; content:"|81 0a 00 00|"; depth:4; reference:cve,2026-59693; classtype:attempted-dos; sid:202659693; rev:1;)

# Volumetric heuristic: repeated BACnet frames from one source to one
# destination within a short window may indicate scripted DoS re-triggering.
alert udp any any -> any 47808 (msg:"CVE-2026-59693 Potential BACnet flood against Siemens Desigo controller"; content:"|81 0a|"; depth:2; threshold: type both, track by_src_dst, count 100, seconds 10; reference:cve,2026-59693; classtype:attempted-dos; sid:202659694; rev:1;)

Elastic Detection

# EQL: Detect 30+ BACnet/IP (UDP 47808) packets between the same source and
# destination within one minute — scripted malformed-packet DoS re-triggering.
sequence by source.ip, destination.ip with maxspan=1m
  [ network where network.transport == "udp" and destination.port == 47808 ] with runs=30

# EQL: Alert on BACnet/IP packets whose length is below the minimum valid
# BVLC frame size (4 bytes), a generic malformed-frame indicator.
any where network.transport == "udp" and destination.port == 47808 and network.bytes < 4

Splunk SPL Query

index=network (sourcetype=*netflow* OR sourcetype=*firewall* OR sourcetype=*pan:traffic*)
| where dest_port=47808 AND transport=udp
| stats count as pkt_count, min(bytes_in) as min_pkt_bytes, max(bytes_in) as max_pkt_bytes
        by src_ip, dest_ip, _time
| where pkt_count > 100 OR min_pkt_bytes <= 4
| eval severity = case(pkt_count > 1000, "high", min_pkt_bytes <= 4, "medium", 1=1, "low")
| table _time, src_ip, dest_ip, pkt_count, min_pkt_bytes, max_pkt_bytes, severity
| sort - _time

Wazuh OSSEC Rule

<group name="network,bacnet,">
  <!-- Baseline: generic UDP 47808 (BACnet/IP) traffic rule -->
  <rule id="100595" level="3">
    <if_sid>510</if_sid>
    <field name="transport">udp</field>
    <field name="dest_port">47808</field>
    <description>BACnet/IP UDP traffic observed on port 47808</description>
    <group>bacnet,</group>
  </rule>

  <!-- High-severity: repeated BACnet traffic from same source (DoS re-triggering) -->
  <rule id="100596" level="12" frequency="100" timeframe="10">
    <if_matched_sid>100595</if_matched_sid>
    <same_source_ip/>
    <description>CVE-2026-59693: possible malformed BACnet packet flood targeting Siemens Desigo controller (UDP 47808) - Denial of Service attempt</description>
    <group>cve-2026-59693,bacnet,attack.t1499,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found from any tracked source, and the vendor fix is listed as N/A. The version numbers cited in the advisory (V01.21.233.16-7862, V02.21.194.36-2715) are the only indication of remediating builds, but their public availability is unverified.

1. Immediate mitigations (before a vendor fix is confirmed):

   • Segment the BACnet/building automation network from corporate IT; where possible, isolate BACnet/IP segments per building or per BMS domain.
   • Use firewalls/ACLs to restrict inbound access to UDP 47808 (and the TCP equivalent if used) to only authorized BMS workstations, supervisory controllers, and BACnet routers.
   • Disable or firewall BACnet/IP communications on any control-network equipment with internet-facing or VPN-exposed interfaces.
   • Implement the detection rules above (especially the Suricata and Splunk volumetric rules) to alert on anomalous BACnet traffic.
   • Document and test the physical/manual reset procedure for affected controllers so facility staff can rapidly restore service if a device is hit.

2. Patch / upgrade steps:

   • Monitor Siemens Industrial Security Advisories (Siemens SSA product-specific notifications) and the NVD page for CVE-2026-59693 for an official firmware update.
   • When the remediating versions become available, upgrade: DXR2 and PXC3 to V01.21.233.16-7862 or later; PXC4, PXC5.E003, PXC5.E24, and PXC7 to V02.21.194.36-2715 or later.
   • Validate firmware integrity via the vendor's prescribed update procedure, and stage the rollout on a single pilot controller before fleet-wide deployment.

3. Long-term hardening:

   • Enforce a zero-trust architecture on the BAS network: device authentication for BACnet endpoints, least-privilege routing, and no direct internet exposure of building controllers.
   • Plan migration toward BACnet/SC (BACnet Secure Connect) or at minimum TLS/IPsec-protected BACnet where the existing device fleet supports it, to add integrity protection and reduce the practical attack surface for packet-injection attacks.
   • Maintain configuration backups for all controllers to accelerate recovery after forced resets.
   • Include BACnet traffic baselines and anomaly detection in the OT SOC monitoring playbook, and treat any malformed-frame activity on UDP 47808 as a priority incident candidate.

References

1. NVD Entry — CVE-2026-59693: https://nvd.nist.gov/vuln/detail/CVE-2026-59693
2. CWE-754 — Improper Check for Unusual or Exceptional Conditions: https://cwe.mitre.org/data/definitions/754.html
3. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. Siemens Desigo product family (supplier reference for affected controller lines): https://www.siemens.com/global/en/products/automation/industry-specific-automation/building-automation-hvac/desigo.html
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-59693 is not currently listed; no exploit-in-the-wild evidence or known threat-actor campaigns associated with this CVE were identified at the time of writing.