EUVD-2026-98409
GHSA-2g62-h8gg-9gf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach controller web service over network
-
DeliverySend crafted upload request
-
ExploitOverflow stack buffer in upload handler
-
ExecutionCrash controller process
-
ImpactDenial of service of building automation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the affected product's web service (the HTTP/upload interface) on an APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, or TALON TC Compact/Modular controller; the attacker sends unvalidated input to the upload code path. Per the CVSS vector no authentication, privileges, or user interaction are needed (PR:N/UI:N/AC:L), so default-reachable deployments are exposed. The primary limiting factor is network exposure: these are OT/BAS controllers typically intended to sit on segmented internal or management networks, so exploitation presupposes the web service is reachable by the attacker (e.g., flat network, internet-exposed device, or insider/adjacent access). Note the P2 Ethernet and PPC variants are listed as 'All versions' with no fixed release in the provided data, whereas PXC Compact/Modular and TALON TC fix at V3.5.7 (BACnet) and V2.8.21 (P2 Ethernet). |
| Impact | This is a stack-based buffer overflow (CWE-121) in the web service upload-handling code of Siemens APOGEE/TALON building-automation controllers, assessed by Siemens at CVSS 4.0 8.7. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, which strongly favors exploitability. Critically, impact is availability-only (VC:N/VI:N/VA:H) - the described outcome is denial of service, not code execution, so despite a stack overflow and a high headline score this is a crash/reboot risk rather than a confidentiality or integrity compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is currently no evidence of active exploitation or weaponization; the risk is latent exploitability rather than demonstrated in-the-wild abuse. Net priority is driven by deployment context: these are OT/building-management controllers that are often network-exposed and poorly segmented, so an unauthenticated remote DoS against physical-plant control equipment can have outsized operational consequences even without RCE. Note a nuance to verify: the tags assert 'Buffer Overflow/Stack Overflow' (implying potential memory corruption), yet the vendor scores impact strictly as availability - confirm with Siemens advisory SSA-333035 whether code execution is truly out of scope. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed APOGEE/TALON controller's web service sends a crafted upload request containing oversized or malformed input that the service fails to validate, overflowing a stack buffer. This crashes or hangs the controller, disrupting the building-automation functions it manages, and requires no credentials or user interaction (AV:N/AC:L/PR:N/UI:N). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Earlier versions of this analysis (1)
Unauthenticated remote attackers can crash the embedded web service on Siemens APOGEE MBC, MEC and PXC building-automation controllers - and on TALON TC Compact and Modular models - by submitting crafted input to the web upload code path, which is mishandled and overflows a stack buffer (CWE-121). Successful exploitation yields a denial-of-service condition only, consistent with the CVSS 3.1 score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning no confidentiality or integrity impact and no authentication or user interaction required. Public exploit code and confirmed active exploitation are both absent from the available intelligence (no CISA KEV listing, no POC reference), and exposure in practice hinges on whether the controller web service is reachable from untrusted network segments, since these devices are normally deployed on isolated OT control networks.
RemediationAI
For APOGEE PXC Compact/Modular and TALON TC Compact/Modular on BACnet, upgrade to V3.5.7 or later; for the P2 Ethernet variants of APOGEE PXC Compact/Modular, upgrade to V2.8.21 or later - these are the vendor-released patch versions identified in the data, and the full update guidance is in Siemens advisory SSA-333035 (https://cert-portal.siemens.com/productcert/html/ssa-333035.html). For the APOGEE MBC (PPC) and MEC (PPC) controllers in both BACnet and P2 Ethernet builds, no vendor-released patch or fixed version is identified at time of analysis, so these must be handled with compensating controls until Siemens publishes a fix. The single most effective control is network restriction of the web service: place these controllers behind a firewall or ACL that blocks inbound TCP access to the embedded HTTP/web configuration interface from anything other than a dedicated engineering workstation or management VLAN, and never expose the device directly to the internet or to flat corporate/building networks - the trade-off is that remote upload and web-based commissioning must be performed from the permitted management hosts only. Where the GUI/upload endpoint is not required in production, disable or block access to the upload page entirely at the network layer; this removes the vulnerable code path from reachability but also prevents legitimate firmware and configuration uploads, so it must be paired with a defined maintenance procedure. Additional compensating measures include segmenting building-automation networks from IT networks, enabling BACnet/IP and P2 traffic filtering to known controller addresses, logging and alerting on HTTP POST/upload requests to controllers, and monitoring for repeated device resets or loss of controller availability as a DoS indicator. Because the affected code is pre-authentication, credential hardening and account management are not sufficient mitigations on their own.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-121, a stack-based buffer overflow, arising because the affected product's web service does not properly validate user-supplied input before copying it into a fixed-size stack buffer inside the upload code path. The vulnerable component is the embedded HTTP/web management service exposed by the controller - the same interface used for firmware uploads and configuration transfers - so the attack surface is the HTTP endpoint that handles multipart or file-upload requests. APOGEE MBC/MEC (PPC) and APOGEE PXC Compact/Modular are Siemens building automation (BAS/BMS) field controllers, and TALON TC Compact/Modular are the corresponding TALON-branded BACnet controllers; they run BACnet and P2 Ethernet communications stacks and are typically deployed on OT/building networks rather than exposed to the internet. Because the overflow occurs in a memory-unsafe code path with pre-authentication reachability, the immediate demonstrated consequence is process/device unavailability (AV:N, AC:L, PR:N, UI:N, VC:N/VI:N/VA:H) rather than code execution; however, stack overflows of this class are frequently escalatable, so the impact should be treated as potentially broader than the pure denial-of-service outcome stated by the vendor. The CPE data confirms ten distinct affected product identifiers spanning the APOGEE and TALON lines, split across BACnet and P2 Ethernet protocol variants, which matters for remediation because the fix versions differ by protocol family.
Know when Apogee Mbc Ppc Bacnet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable upload parsing with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is availability-only (crash) so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.
Executive ViewAI
Siemens APOGEE and TALON building-automation controllers are exposed to a high-severity, unauthenticated remote denial-of-service condition that can crash devices and disrupt building operations. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, but the low-complexity network attack path means any reachable HTTP upload interface is at risk. Leadership should prioritize inventory, network isolation, and vendor engagement because affected controllers often support HVAC, energy, and facility systems whose outage can affect tenant safety and business continuity.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating affected controllers on dedicated management VLANs, blocking external access to HTTP upload services, restricting administrative access to authorized jump hosts, disabling upload functionality where not required, monitoring for unexpected crashes or reboots, and maintaining offline backups/configurations for rapid restoration. Apply vendor mitigations and firmware updates as soon as Siemens releases them.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apogee Mbc Ppc Bacnet
View allUnauthenticated remote attackers can read portions of device memory or cause a denial-of-service condition in Siemens AP
Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC
Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automa
Exploit-DB