Siemens APOGEE Controllers EUVD-2026-98408

Exploitation requires network reachability to the affected controller's HTTP web service and the ability to send a crafted multipart request; per CVSS PR:N/UI:N no authentication or user interaction is needed, and it works against default configurations. The practical limiting factor is exposure of the web management interface - these are OT building-automation controllers typically expected to reside on segmented/isolated networks, so risk is sharply reduced where the web service is not reachable from untrusted networks. Version-bounded products (APOGEE PXC Compact/Modular, TALON TC) are only affected below the listed fixed versions, whereas APOGEE MBC/MEC (PPC) variants are affected in all versions.

This is a credible operational-technology risk for exposed devices but not a confirmed widespread-exploitation emergency. The Siemens-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, which is why the base score is high at 8.7. However, impact is confined to availability (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), so this is strictly a denial-of-service issue, not code execution. Notably, the CWE is CWE-121 (stack-based buffer overflow) and tags include 'Stack Overflow' and 'Buffer Overflow' - which often carry RCE potential - yet Siemens scored only availability impact; this signal conflict should be verified against the vendor advisory, as the practical ceiling may be a controller crash/reboot rather than memory-corruption-driven execution. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation; the real-world urgency therefore depends almost entirely on whether a given controller's web service is network-reachable. For OT/building-automation assets that are properly segmented, real risk is moderate despite the high CVSS; for internet- or flat-network-exposed controllers it is materially higher.

An attacker with network access to an APOGEE/TALON controller's web service sends a malformed multipart HTTP request whose crafted input is not properly validated, overflowing a stack buffer and crashing the controller's web service. This can take the building-automation controller offline (loss of monitoring/control of HVAC or facility functions) without any credentials or user interaction. No public exploit code has been identified in the provided data, so exploitation would currently require an attacker to develop the request independently.