Siemens APOGEE EUVD-2026-98407

The controller's FTP service must be enabled and network-reachable by the attacker; exploitation is remote and unauthenticated (PR:N, UI:N) against that service. Impact is limited to availability (service/device crash) - there is no confidentiality or integrity impact and no vendor claim of code execution. The principal limiting factor is network exposure: these are OT building-automation controllers normally expected to sit on segmented, non-internet-facing networks, so reachability of the FTP port from an attacker's position is the key real-world precondition. Additionally, APOGEE PXC/Modular and TALON TC devices are only affected below the listed fixed versions (BACnet < V3.5.7, P2 Ethernet < V2.8.21), while the MBC/MEC PPC families are listed as all versions.

This is a genuine operational-technology concern but not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vector requiring no user interaction, which is why Siemens rates it 8.7 (High). However, impact is strictly availability (VA:H; VC:N/VI:N - no confidentiality or integrity loss, no scope change), so this is a denial-of-service/crash issue consistent with CWE-121 stack buffer overflow, NOT confirmed remote code execution despite the stack-overflow primitive. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency therefore rests on exposure rather than on known in-the-wild activity. The dominant risk driver is deployment context: these are building-automation controllers that in well-architected environments should be on segmented OT networks and not internet-facing, which materially reduces the practical attack surface implied by AV:N. Note a data gap - several affected products (APOGEE MBC and MEC families) are listed as 'All versions' with no fixed version in the provided data, so remediation status for those must be verified against Siemens advisory SSA-333035.

An attacker with network access to a controller's FTP service sends a crafted command or argument containing an overly long, user-controllable string that exceeds the expected buffer length. The unvalidated length triggers a stack buffer overflow that crashes or hangs the FTP service or the controller firmware, disrupting building-automation functions. No authentication is required and no POC is referenced in the available data.