Siemens APOGEE/TALON: Denial of service via crafted multipart input
Summary
Several Siemens APOGEE (PPC, PXC) and TALON building automation controllers do not properly validate user input in the multipart handling of their web service. An unauthenticated remote attacker can exploit this to cause a denial of service and impair the availability of the device. The FTP/Web service is disabled by default, so the risk mainly applies where it has been enabled. The CWE classification is provisional and not confirmed by Siemens.
Affected
- APOGEE MBC (PPC) (BACnet and P2 Ethernet), all versions
- APOGEE MEC (PPC) (BACnet and P2 Ethernet), all versions
- APOGEE PXC Compact and Modular (BACnet), before V3.5.7
- APOGEE PXC Compact and Modular (P2 Ethernet), before V2.8.21
- TALON TC Compact and Modular (BACnet), before V3.5.7
Fixed in
- APOGEE PXC Compact/Modular (BACnet): V3.5.7 or later
- APOGEE PXC Compact/Modular (P2 Ethernet): V2.8.21 or later
- TALON TC Compact/Modular (BACnet): V3.5.7 or later
- APOGEE MBC and MEC (PPC): no fix planned according to the Siemens advisory
Workaround
- Disable the FTP/Web service (disabled by default on these products)
- For products without a fix: network segmentation and properly configured firewalls or gateways
Exploitation
No exploitation known. CISA SSVC: Exploitation none, Automatable yes. No public proof of concept was found in the research.
Our recommendation
- Inventory APOGEE and TALON controllers and their firmware versions, and check whether the web service is enabled
- Disable the web service where it is not required
- Restrict access to controller networks with segmentation and firewall rules
- Update BACnet variants to V3.5.7 and P2 Ethernet variants to V2.8.21 where available; for PPC models without a fix, rely on segmentation and contact Siemens
- Monitor for unexpected device unavailability
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Siemens SSA-333035 security advisory cert-portal.siemens.com
- CISA ICS advisory ICSA-26-295-08 www.cisa.gov
- VulDB CVE-2026-102075 vuldb.com
- CystACK Siemens vulnerability database cystack.net
- CVE-2026-102075 advisory mirror cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:36.
Original description (NVD)
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.