This vulnerability (CVE-2026-59693) impacts several Siemens Desigo building automation devices. An attacker with network access can send a malformed BACnet packet to the device, causing it to become unresponsive to BACnet queries, effectively resulting in a denial-of-service condition. The affected devices require a manual reset or reboot to restore normal operation. The vulnerability affects all versions prior to V01.21.233.16-7862 for Desigo DXR2 and PXC3, and all versions prior to V02.21.194.36-2715 for Desigo PXC4, PXC5.E003, PXC5.E24, and PXC7. The CVSS 3.1 base score is 4.3, reflecting a medium severity with no confidentiality or integrity impact, only availability. There is no indication of known exploits in the wild or vendor-provided patches at this time.

The vulnerability allows an unauthenticated attacker with network access to cause a denial-of-service by sending malformed BACnet packets. This results in the affected device ceasing to respond to BACnet queries, disrupting normal device operation and potentially impacting building automation functions. Recovery requires manual intervention via device reset or reboot. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider network-level controls to restrict unauthorized BACnet traffic to these devices. Monitoring for unusual BACnet traffic patterns may help detect exploitation attempts. Manual device reset or reboot is required to recover from the DoS condition.