CVE-2026-102074

Siemens APOGEE and TALON building-automation controllers have a stack-based buffer overflow (CWE-121) in the FTP service because it does not properly check the length of user-controllable input. An unauthenticated remote attacker who can reach the FTP service can send oversized input and crash the device, causing a denial of service; the advisory and CVSS 4.0 score (8.7) describe high availability impact only, with no confidentiality or integrity impact. Affected products are APOGEE MBC and MEC (PPC) on BACnet and P2 Ethernet (all versions), APOGEE PXC Compact and Modular below the fixed BACnet and P2 Ethernet releases, and TALON TC Compact and Modular (BACnet) below V3.5.7. The issue is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade APOGEE PXC Compact and Modular (BACnet) and TALON TC Compact and Modular (BACnet) to V3.5.7 or later, and APOGEE PXC Compact and Modular (P2 Ethernet) to V2.8.21 or later. No fixed release is listed for APOGEE MBC (PPC) or MEC (PPC); disable the FTP service if it is not required, and keep these controllers off the internet behind segmented building networks with access limited to trusted management hosts. Confirm firmware versions and that FTP is not reachable from untrusted networks.