Full Report
The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Siemens APOGEE, TALON, and Desigo PXC/PXM Products
## CVE Details
- **CVE ID:** CVE-2026-102073
- **CVSS Score:** 8.8 (High) - CVSS v4.0 / 8.2 (High) - CVSS v3.1
- **CWE:** CWE-191: Integer Underflow (Wrap or Wraparound)
- **CVE ID:** CVE-2026-102074
- **CVSS Score:** 8.7 (High) - CVSS v4.0 / 7.5 (High) - CVSS v3.1
- **CWE:** CWE-121: Stack-based Buffer Overflow
- **CVE ID:** CVE-2026-102075
- **CVSS Score:** 8.7 (High) - CVSS v4.0 / 7.5 (High) - CVSS v3.1
- **CWE:** CWE-121: Stack-based Buffer Overflow
- **CVE ID:** CVE-2026-102076
- **CVSS Score:** 8.7 (High) - CVSS v4.0 / 7.5 (High) - CVSS v3.1
- **CWE:** CWE-121: Stack-based Buffer Overflow
- **CVE ID:** CVE-2026-89208
- **CVSS Score:** Linked to CVSS 8.8 (Base Score listed for advisory)
## Affected Systems
- **Products:**
- APOGEE MBC (PPC) (BACnet and P2 Ethernet)
- APOGEE MEC (PPC) (BACnet and P2 Ethernet)
- APOGEE PXC Compact (BACnet)
- Desigo PXC00-U, PXC001-E.D, PXC12-E.D, PXC22-E.D, PXC22.1-E.D
- TALON Series (Implicitly included based on title)
- **Versions:**
- APOGEE/Desigo PXC/PXM: All versions ≥ V2.3 are affected by CVE-2026-89208.
- APOGEE MBC/MEC: All versions affected by CVEs 102073, 102074, 102075, and 102076.
- **Configurations:** Devices with FTP services or Web services enabled are primary targets.
## Vulnerability Description
The advisory covers several memory corruption flaws:
- **CVE-2026-102073:** An integer underflow in the FTP service allows an unauthenticated remote attacker to read device memory or trigger a Denial of Service (DoS) via crafted input.
- **CVE-2026-102074:** A stack-based buffer overflow in the FTP service due to improper input length validation, leading to DoS.
- **CVE-2026-102075:** A stack-based buffer overflow in the web service's multipart handling, leading to DoS.
- **CVE-2026-102076:** A stack-based buffer overflow in the web service's upload code, leading to DoS.
## Exploitation
- **Status:** Not reported as exploited in the wild; coordinated disclosure by Forescout Technologies.
- **Complexity:** Low (requires no specialized conditions).
- **Attack Vector:** Network (Unauthenticated remote access).
## Impact
- **Confidentiality:** High (for CVE-2026-102073, allowing memory reads); None for others.
- **Integrity:** None.
- **Availability:** High (All CVEs lead to Denial of Service).
## Remediation
### Patches
- Siemens has released new versions for "several affected products" (Refer to the full advisory for specific version numbers as they become available).
- **Note:** For APOGEE MBC (PPC) and MEC (PPC) lines, **no fix is currently planned.**
### Workarounds
- **Disable Unused Services:** Disable FTP and Web services on the devices if not strictly required for operations.
- **Network Segmentation:** Ensure the affected devices are not accessible from the internet and are placed in a protected management network.
- **Apply General Security Recommendations:** Follow Siemens' Operational Guidelines for Industrial Security.
## Detection
- **Indicators of Compromise:** Unexpected device reboots or loss of communication with building automation controllers.
- **Detection methods:** Monitor network traffic for unusual FTP commands or malformed multipart HTTP requests targeting industrial controllers.
## References
- **Vendor Advisory:** hxxps://cert-portal.siemens[.]com/productcert/html/ssa-333035.html
- **Siemens Security Inquiries:** hxxps://www.siemens[.]com/cert/advisories
- **Terms of Use:** hxxps://www.siemens[.]com/productcert/terms-of-use