Siemens APOGEE and TALON controllers: Out-of-bounds read and denial of service via web service

Summary

Multiple Siemens APOGEE MBC, MEC, PXC and TALON TC controllers do not properly validate the length of user-controllable input in their web service. An unauthenticated remote attacker can read portions of device memory or cause a denial-of-service condition. The advisory states the web service (FTP/Web) is disabled by default, so exposure depends on whether it is enabled and reachable on the network.

Affected

• APOGEE MBC (PPC) (BACnet) and (P2 Ethernet): all versions
• APOGEE MEC (PPC) (BACnet) and (P2 Ethernet): all versions
• APOGEE PXC Compact and PXC Modular (BACnet): versions below V3.5.7
• APOGEE PXC Compact and PXC Modular (P2 Ethernet): versions below V2.8.21 (secondary source, to be verified)
• TALON TC Compact and TC Modular (BACnet): versions below V3.5.7

Fixed in

• APOGEE PXC Compact and Modular (BACnet): V3.5.7 or later
• APOGEE PXC Compact and Modular (P2 Ethernet): V2.8.21 or later (to be verified against the Siemens advisory)
• TALON TC Compact and Modular (BACnet): V3.5.7 or later
• APOGEE MBC and MEC: Unknown. No fix found in the sources; Siemens states no fix is currently planned for these products.

Workaround

• Disable the FTP/Web service on affected devices if it is not required (disabled by default on these products).
• Segment building automation networks from office, guest and internet-facing networks.
• No specific mitigation for MBC and MEC beyond the general advice; confirm with Siemens.

Exploitation

• CVSS v4.0 base score 8.8 as reported; not independently verified.
• VulDB reports no exploit available.
• No public proof of concept and no confirmed exploitation in the wild found.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

• Inventory all APOGEE, TALON and BACnet controllers, including firmware versions.
• Disable the FTP/Web service where it is not needed.
• Keep building automation networks segmented and block any internet exposure of the controllers.
• Update PXC and TALON BACnet devices to V3.5.7 or later, and P2 Ethernet PXC devices to V2.8.21 or later after verification.
• For MBC and MEC devices, ask Siemens for the remediation status and plan replacement with PXC devices if no fix is available.
• Monitor the Siemens advisory SSA-333035 and CISA for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Siemens SSA-333035 cert-portal.siemens.com
• CISA ICS Advisory ICSA-26-295-08 www.cisa.gov
• VulDB CVE-2026-102073 vuldb.com
• Vulners CVE-2026-102073 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:15.