Siemens APOGEE/TALON/PXC: Denial of service in FTP service

Summary

Multiple Siemens APOGEE, TALON TC and PXC building automation controllers do not properly validate the length of input to their FTP service. An unauthenticated remote attacker who can reach the FTP service over the network can cause a denial of service and disrupt the device's availability. The FTP/Web service is disabled by default, so exposure depends on whether it has been enabled and is reachable.

Affected

• APOGEE MBC (PPC) (BACnet), all versions
• APOGEE MBC (PPC) (P2 Ethernet), all versions
• APOGEE MEC (PPC) (BACnet), all versions
• APOGEE MEC (PPC) (P2 Ethernet), all versions
• APOGEE PXC Compact (BACnet), versions before V3.5.7
• APOGEE PXC Compact (P2 Ethernet), versions before V2.8.21
• APOGEE PXC Modular (BACnet), versions before V3.5.7
• APOGEE PXC Modular (P2 Ethernet), versions before V2.8.21
• TALON TC Compact (BACnet), versions before V3.5.7
• TALON TC Modular (BACnet), versions before V3.5.7

Fixed in

• APOGEE PXC Compact and Modular (BACnet): update to V3.5.7 or later
• APOGEE PXC Compact and Modular (P2 Ethernet): update to V2.8.21 or later
• TALON TC Compact and Modular (BACnet): update to V3.5.7 or later (the upper bound in the advisory should be confirmed)
• APOGEE MBC and MEC (PPC), BACnet and P2 Ethernet: the advisory lists no fix planned

Workaround

• Disable the FTP/Web service on affected devices; Siemens states it is disabled by default
• Restrict network access to the controllers with firewalls or properly configured gateways, and separate them from the office network

Exploitation

• No known exploitation in the wild at the time of writing
• No public proof of concept found
• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial

Our recommendation

• Inventory all APOGEE, TALON and PXC devices and their firmware versions, including MBC and MEC
• Check that the FTP and Web service is disabled on every device and disable it where it is not needed
• Block building automation ports from the internet and limit access to the building network
• Update PXC and TALON devices to the fixed versions; for MBC and MEC, follow Siemens guidance in SSA-333035 or contact Siemens
• Monitor for exploitation news and recheck NVD and the Siemens advisory, as they may be updated

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Siemens ProductCERT SSA-333035 cert-portal.siemens.com
• CISA ICS Advisory ICSA-26-295-08 www.cisa.gov
• VulDB entry 417517 vuldb.com
• Strix CVE-2026-102074 www.strix.ai
• Vulners CVELIST CVE-2026-102074 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:36.