CVE-2026-102073

Siemens APOGEE and TALON building-automation controllers fail to properly validate the length of user-controllable input in the embedded web service, an integer-underflow class flaw (CWE-191). An unauthenticated remote attacker who can reach that web service can send crafted input that reads portions of device memory or causes a denial-of-service condition. Impact is high confidentiality and low availability on the device itself, with no integrity change and no follow-on impact scored on other systems. The issue affects all versions of APOGEE MBC and MEC (PPC) BACnet and P2 Ethernet controllers, APOGEE PXC Compact and Modular controllers below the fixed firmware levels, and TALON TC Compact and Modular BACnet controllers below V3.5.7, which are used in commercial building management systems. No public proof-of-concept is known, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade APOGEE PXC Compact and Modular (BACnet) and TALON TC Compact and Modular to V3.5.7 or later, and APOGEE PXC Compact and Modular (P2 Ethernet) to V2.8.21 or later. No fixed release is identified for APOGEE MBC and MEC (all versions), so isolate those controllers from untrusted networks and follow Siemens guidance on replacement or compensating controls. Until devices are patched, keep the controller web service off the internet, restrict it to trusted management hosts, and segment building-automation networks.