IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products

HIGH
CVSS 8.2
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.

// Vulnerabilities (5)

CVE ID CVSS Score Severity Description
CVE-2026-102074 7.5 high
CVE-2026-102074. The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.
CVE-2026-102076 7.5 high
CVE-2026-102076. The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.
CVE-2026-102075 7.5 high
CVE-2026-102075. The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.
CVE-2026-89208 5.3 medium
CVE-2026-89208. The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.
CVE-2026-102073 8.2 high
CVE-2026-102073. The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.

// Remediations (10)

Mitigation:  CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configure
 CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
Patch: Update to V3.5.7 or later version
Update to V3.5.7 or later version
Mitigation: Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo,
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)
Patch: Update to V2.8.21 or later version
Update to V2.8.21 or later version
Patch: Update to V3.5.7 or later version
Update to V3.5.7 or later version
Patch: Update to V3.5.7 or later version
Update to V3.5.7 or later version
Patch: Update to V3.5.7 or later version
Update to V3.5.7 or later version
Patch: Update to V2.8.21 or later version
Update to V2.8.21 or later version
Patch: Update to V2303 or later version
Update to V2303 or later version
Mitigation: Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

// References