Siemens APOGEE, TALON and Desigo flaws can cause denial of service
Original title: Siemens APOGEE, TALON and Desigo PXC/PXM Products
Several Desigo controllers at version 2.3 and later have no planned fix for CVE-2026-89208.
CISA republished a Siemens advisory covering APOGEE, TALON and Desigo PXC/PXM building controllers. The flaws could let an attacker cause a denial of service and affect device availability. CVE-2026-89208 is an unauthenticated remote out-of-bounds packet read; Siemens says no fix is planned for the listed Desigo products and advises network segmentation. New versions are available for several other affected products.
Unconfirmed: The advisory text is truncated, and it does not state whether any flaw is exploited.
- APOGEE PXC Compact and Modular BACnet builds before 3.5.7 are affected.
- APOGEE PXC Compact and Modular P2 Ethernet builds before 2.8.21 are affected.
- Some APOGEE MBC and MEC PPC variants are affected in all versions.
- CVE-2026-89208 affects listed Desigo PXC and PXM products at version 2.3 and later.
- A listed CVSS v3 score is 8.2; exploitation is not mentioned.
Impact: Denial of service and out-of-bounds memory reads
| Product | Affected | Fixed in |
|---|---|---|
| Siemens APOGEE PXC Compact/Modular (BACnet) | before 3.5.7 | 3.5.7 |
| Siemens APOGEE PXC Compact/Modular (P2 Ethernet) | before 2.8.21 | 2.8.21 |
| Siemens APOGEE MBC/MEC (PPC) | all | — |
| Siemens TALON TC Compact/Modular (BACnet) | before 3.5.7 | 3.5.7 |
| Siemens Desigo PXC/PXM products | >=2.3 | — |
- 1.Update products that have new versions to the latest Siemens releases.
- 2.Segment networks and place unfixed controllers behind configured gateways or firewalls.
- Vendors
- Siemens
- Products
- APOGEETALONDesigo PXCDesigo PXM
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-102073+3 related CVEs | Memory disclosure and DoS in Siemens APOGEE and TALON controllers | 8.8 group max | — | ||
| CVE-2026-89208 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo… | 6.9 | — |
From the original article
11 min read at cisa.govView CSAF Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.