CVE-2026-102075

Siemens APOGEE and TALON building-automation controllers have a flaw in the web service’s handling of multipart input (CWE-121, stack-based buffer overflow). An unauthenticated remote attacker can send crafted input that the service does not properly validate and thereby cause a denial of service; the advisory reports high availability impact and no confidentiality or integrity impact. Affected products are APOGEE MBC (PPC) and MEC (PPC) on BACnet and P2 Ethernet (all versions), APOGEE PXC Compact and Modular below the fixed BACnet and P2 Ethernet releases, and TALON TC Compact and Modular (BACnet) below V3.5.7. These are commercial building controllers, often on facility networks rather than the public internet. There is no known public proof of concept, and the CVE is not listed in CISA KEV.

What to do: Upgrade APOGEE PXC Compact and Modular (BACnet) and TALON TC Compact and Modular to V3.5.7 or later, and APOGEE PXC Compact and Modular (P2 Ethernet) to V2.8.21 or later. No fixed version is listed for APOGEE MBC (PPC) or MEC (PPC) on BACnet or P2 Ethernet; keep those controllers off the internet, restrict the web service to trusted management networks, and apply any Siemens advisory mitigations. Confirm devices are not reachable from untrusted networks and watch for unexpected web-service crashes or restarts.