APOGEE, TALON: Stack-based buffer overflow in web service enables denial of service

Summary

Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact and Modular, and TALON TC Compact and Modular building controllers contain a stack-based buffer overflow (CWE-121) in the upload handling of their web service. An unauthenticated remote attacker can send crafted input over the network to crash the affected device and cause a denial of service. Only availability is affected; the CNA rates confidentiality and integrity as not impacted.

Affected

• APOGEE MBC (PPC) and MEC (PPC), BACnet and P2 Ethernet: all versions
• APOGEE PXC Compact and Modular, BACnet: all versions below V3.5.7
• APOGEE PXC Compact and Modular, P2 Ethernet: all versions below V2.8.21
• TALON TC Compact and Modular, BACnet: all versions below V3.5.7

Fixed in

• APOGEE PXC Compact and Modular, BACnet: V3.5.7 or later
• APOGEE PXC Compact and Modular, P2 Ethernet: V2.8.21 or later
• TALON TC Compact and Modular, BACnet: V3.5.7 or later (as listed in the advisory; verify in the full advisory)
• APOGEE MBC/MEC (PPC): no fix known from the sources; check the Siemens advisory
• Firmware is obtained via the Siemens partner portal.

Workaround

• Disable the FTP/Web service on the affected devices. Siemens notes it is disabled by default on APOGEE, Desigo and TALON products.
• Check first whether BACnet web pages or remote management depend on the service.
• Segment the controllers and place them behind properly configured gateways or firewalls.

Exploitation

• No evidence of exploitation in the wild found. CISA ADP Vulnrichment does not mark the CVE as known exploited.
• No public proof-of-concept found.
• Market estimate of exploit price by VulDB (USD 5k-25k) is not evidence of use.
• The CVSS 4.0 score is 8.7 in the CNA record, while the Siemens advisory lists 8.8.

Our recommendation

• Inventory all APOGEE, TALON and PXC controllers and their firmware versions, including P2 Ethernet and BACnet variants.
• Confirm that none of the controllers are reachable from the internet or from untrusted networks.
• Disable the FTP/Web service where operations allow it.
• Plan the firmware update to V3.5.7 or V2.8.21 where a fix exists, and follow the Siemens advisory for APOGEE MBC/MEC.
• Monitor the building automation network for unusual traffic and device restarts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Siemens SSA-333035 Security Advisory cert-portal.siemens.com
• CISA ICS Advisory ICSA-26-295-08 www.cisa.gov
• CISA ADP Vulnrichment entry (hol.org) hol.org
• VulDB entry CVE-2026-102076 vuldb.com
• Security Boulevard OT security news, October 24, 2026 securityboulevard.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:37.