Apogee Pxc Modular P2 Ethernet
Monthly
A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC building-automation controllers, caused by improper validation of multipart input that can crash the service via a stack buffer overflow (CWE-121). An unauthenticated remote attacker with network reachability to the controller's HTTP interface (CVSS PR:N/UI:N) can send a crafted multipart request and take the web service down; the assessed impact is availability-only (C:N/I:N/A:H), with no confidentiality or integrity loss demonstrated. Exploitation is bounded by exposure: these are OT field panels normally expected on segmented building networks, and no public exploit code has been identified at time of analysis - this is a credible OT risk for internet- or IT-reachable controllers, not a confirmed widespread-exploitation emergency. All-version APOGEE MBC/MEC (PPC) models carry the highest residual risk because no fixed version is listed for them, whereas APOGEE PXC Compact/Modular (BACnet) and TALON TC are fixed at V3.5.7 and the P2 Ethernet PXC Compacts at V2.8.21.
Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automation controllers by sending a crafted input that triggers a stack-based buffer overflow (CWE-121) in the device's FTP service. The flaw affects all versions of the MBC and MEC PPC families and PXC/TALON TC models below BACnet V3.5.7 or P2 Ethernet V2.8.21. No public exploit code or confirmed active exploitation has been identified, and the impact is limited to availability (no confidentiality or integrity impact); real-world risk hinges on whether the FTP service is enabled and reachable from an attacker's position on the OT network.
Unauthenticated remote attackers can read portions of device memory or cause a denial-of-service condition in Siemens APOGEE MBC/MEC and PXC, and TALON TC building controllers through the embedded web service, due to improper length validation of user-controllable input (CWE-191 integer underflow). Affected versions include APOGEE PXC Compact/Modular (BACnet) before V3.5.7 and (P2 Ethernet) before V2.8.21, TALON TC Compact/Modular (BACnet) before V3.5.7, and all versions of APOGEE MBC and MEC. No public exploit has been identified at the time of analysis; the vendor has released patches for the PXC and TALON variants, but no fix is available for MBC/MEC.
A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC building-automation controllers, caused by improper validation of multipart input that can crash the service via a stack buffer overflow (CWE-121). An unauthenticated remote attacker with network reachability to the controller's HTTP interface (CVSS PR:N/UI:N) can send a crafted multipart request and take the web service down; the assessed impact is availability-only (C:N/I:N/A:H), with no confidentiality or integrity loss demonstrated. Exploitation is bounded by exposure: these are OT field panels normally expected on segmented building networks, and no public exploit code has been identified at time of analysis - this is a credible OT risk for internet- or IT-reachable controllers, not a confirmed widespread-exploitation emergency. All-version APOGEE MBC/MEC (PPC) models carry the highest residual risk because no fixed version is listed for them, whereas APOGEE PXC Compact/Modular (BACnet) and TALON TC are fixed at V3.5.7 and the P2 Ethernet PXC Compacts at V2.8.21.
Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automation controllers by sending a crafted input that triggers a stack-based buffer overflow (CWE-121) in the device's FTP service. The flaw affects all versions of the MBC and MEC PPC families and PXC/TALON TC models below BACnet V3.5.7 or P2 Ethernet V2.8.21. No public exploit code or confirmed active exploitation has been identified, and the impact is limited to availability (no confidentiality or integrity impact); real-world risk hinges on whether the FTP service is enabled and reachable from an attacker's position on the OT network.
Unauthenticated remote attackers can read portions of device memory or cause a denial-of-service condition in Siemens APOGEE MBC/MEC and PXC, and TALON TC building controllers through the embedded web service, due to improper length validation of user-controllable input (CWE-191 integer underflow). Affected versions include APOGEE PXC Compact/Modular (BACnet) before V3.5.7 and (P2 Ethernet) before V2.8.21, TALON TC Compact/Modular (BACnet) before V3.5.7, and all versions of APOGEE MBC and MEC. No public exploit has been identified at the time of analysis; the vendor has released patches for the PXC and TALON variants, but no fix is available for MBC/MEC.