TI-2020-16432 Aliases CVE-2020-27009 GHSA-wfpc-6x9w-jf83

Out-of-bounds write in Siemens APOGEE PXC Compact

MEDIUM 45CWE-823Published 2021-04-22 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.

Why it matters now

EPSS 0.07194 94th percentileScored 2026-11-07

Fix Fixed APOGEE PXC Compact (BACnet) (Siemens): V3.5.5APOGEE PXC Compact (P2 Ethernet) (Siemens): V2.8.20+5 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	APOGEE PXC Compact (BACnet)	before V3.5.5	V3.5.5	Patch available	CNA
Siemens	APOGEE PXC Compact (P2 Ethernet)	before V2.8.20	V2.8.20	Patch available	CNA
Siemens	APOGEE PXC Modular (BACnet)	before V3.5.5	V3.5.5	Patch available	CNA
Siemens	APOGEE PXC Modular (P2 Ethernet)	before V2.8.20	V2.8.20	Patch available	CNA
Siemens	Nucleus NET	before V5.2	V5.2	Patch available	CNA
Siemens	Nucleus Source Code	Versions including affected DNS modules	—	No fix listed	CNA
Siemens	TALON TC Compact (BACnet)	before V3.5.5	V3.5.5	Patch available	CNA
Siemens	TALON TC Modular (BACnet)	before V3.5.5	V3.5.5	Patch available	CNA

APOGEE PXC Compact (BACnet) VendorSiemens Affected before V3.5.5 Fixed in V3.5.5 Patch available CNA
APOGEE PXC Compact (P2 Ethernet) VendorSiemens Affected before V2.8.20 Fixed in V2.8.20 Patch available CNA
APOGEE PXC Modular (BACnet) VendorSiemens Affected before V3.5.5 Fixed in V3.5.5 Patch available CNA
APOGEE PXC Modular (P2 Ethernet) VendorSiemens Affected before V2.8.20 Fixed in V2.8.20 Patch available CNA
Nucleus NET VendorSiemens Affected before V5.2 Fixed in V5.2 Patch available CNA
Nucleus Source Code VendorSiemens Affected Versions including affected DNS modules Fixed in — No fix listed CNA
TALON TC Compact (BACnet) VendorSiemens Affected before V3.5.5 Fixed in V3.5.5 Patch available CNA
TALON TC Modular (BACnet) VendorSiemens Affected before V3.5.5 Fixed in V3.5.5 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:nucleus_net::::::::	before 5.2	Vulnerable	Siemens
cpe:2.3:a:siemens:nucleus_source_code:-:::::::*	not specified by NVD	Vulnerable	Siemens

cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:* Versions before 5.2 Vulnerable ·Siemens
cpe:2.3:a:siemens:nucleus_source_code:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens

Remediation

Fix · CNA APOGEE PXC Compact (BACnet) (Siemens) Fixed in V3.5.5
Fix · CNA APOGEE PXC Compact (P2 Ethernet) (Siemens) Fixed in V2.8.20
Fix · CNA APOGEE PXC Modular (BACnet) (Siemens) Fixed in V3.5.5
Fix · CNA APOGEE PXC Modular (P2 Ethernet) (Siemens) Fixed in V2.8.20
Fix · CNA Nucleus NET (Siemens) Fixed in V5.2
Fix · CNA TALON TC Compact (BACnet) (Siemens) Fixed in V3.5.5
Fix · CNA TALON TC Modular (BACnet) (Siemens) Fixed in V3.5.5

Timeline

2026-10-02 Threatist record created from CVE-2020-27009
2026-10-03 Alias added: GHSA-wfpc-6x9w-jf83

References

Advisory 1

https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf

Other 1

https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf

TI-2021-11875 Out-of-bounds write in Siemens APOGEE MBC CVSS 3.1CRITICAL 9.8
TI-2022-17998 Uncontrolled resource consumption in Siemens APOGEE MBC CVSS 4.0HIGH 8.7
TI-2021-11873 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE… CVSS 3.1CRITICAL 9.8
TI-2020-12430 Out-of-bounds write in Siemens APOGEE PXC Compact CVSS 3.1HIGH 8.1
TI-2021-11879 A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All… CVSS 3.1CRITICAL 9.1
TI-2021-11878 Integer underflow in Siemens Capital Embedded AR Classic 431-422 CVSS 3.1CRITICAL 9.1

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences