Siemens APOGEE, TALON and Desigo flaws can cause denial of service
Several Desigo controllers at version 2.3 and later have no planned fix for CVE-2026-89208.
62
CVE-2026-102076
Unauthenticated DoS in Siemens APOGEE and TALON controllers
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens APOGEE and TALON building-automation controllers have a flaw in the web service upload code that does not properly validate user-supplied input (CWE-121, stack-based buffer overflow). An unauthenticated remote attacker can send crafted input over the network and crash the affected service, causing a denial of service. The CVSS 4.0 score is 8.7 (high) with high availability impact and no confidentiality or integrity impact. Affected products include all versions of APOGEE MBC and MEC (PPC) on BACnet and P2 Ethernet, APOGEE PXC Compact and Modular below the fixed BACnet and P2 Ethernet releases, and TALON TC Compact and Modular (BACnet) below V3.5.7. It is not on the CISA KEV list, and no public proof-of-concept or in-the-wild exploitation is known.
What to do: Upgrade APOGEE PXC Compact and Modular (BACnet) and TALON TC Compact and Modular to V3.5.7 or later, and APOGEE PXC Compact and Modular (P2 Ethernet) to V2.8.21 or later. No fixed version is listed for APOGEE MBC (PPC) or MEC (PPC); keep those controllers off the internet, restrict access to the web service to trusted management networks, and follow Siemens ProductCERT guidance.
| Product | Affected |
|---|---|
| Siemens APOGEE MBC (PPC) (BACnet) | All versions |
| Siemens APOGEE MBC (PPC) (P2 Ethernet) | All versions |
| Siemens APOGEE MEC (PPC) (BACnet) | All versions |
| Siemens APOGEE MEC (PPC) (P2 Ethernet) | All versions |
| Siemens APOGEE PXC Compact (BACnet) | All versions < V3.5.7 |
| Siemens APOGEE PXC Compact (P2 Ethernet) | All versions < V2.8.21 |
| Siemens APOGEE PXC Modular (BACnet) | All versions < V3.5.7 |
| Siemens APOGEE PXC Modular (P2 Ethernet) | All versions < V2.8.21 |
| Siemens TALON TC Compact (BACnet) | All versions < V3.5.7 |
| Siemens TALON TC Modular (BACnet) | All versions < V3.5.7 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.
- Weakness
- CWE-121
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X