A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE…
Priority LOW 35CWE-805Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). TFTP server application allows for reading the contents of the TFTP memory buffer via sending malformed TFTP commands. (FSMD-2021-0009)
Why it matters now
EPSS 0.01237 69th percentileScored 2026-11-07
Fix Fixed APOGEE PXC Compact (BACnet) (Siemens): V3.5.4APOGEE PXC Compact (P2 Ethernet) (Siemens): V2.8.19+6 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | APOGEE MBC (PPC) (BACnet) | All versions | — | No fix listed | CNA |
| Siemens | APOGEE MBC (PPC) (P2 Ethernet) | All versions | — | No fix listed | CNA |
| Siemens | APOGEE MEC (PPC) (BACnet) | All versions | — | No fix listed | CNA |
| Siemens | APOGEE MEC (PPC) (P2 Ethernet) | All versions | — | No fix listed | CNA |
| Siemens | APOGEE PXC Compact (BACnet) | before V3.5.4 | V3.5.4 | Patch available | CNA |
| Siemens | APOGEE PXC Compact (P2 Ethernet) | before V2.8.19 | V2.8.19 | Patch available | CNA |
| Siemens | APOGEE PXC Modular (BACnet) | before V3.5.4 | V3.5.4 | Patch available | CNA |
| Siemens | APOGEE PXC Modular (P2 Ethernet) | before V2.8.19 | V2.8.19 | Patch available | CNA |
| Siemens | Desigo PXC00-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC00-U | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC001-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC100-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC12-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC128-U | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC200-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC22-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC22.1-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC36.1-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC50-E.D | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXC64-U | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Desigo PXM20-E | All versions >= V2.3 and < V6.30.016 | — | No fix listed | CNA |
| Siemens | Nucleus NET | All versions | — | No fix listed | CNA |
| Siemens | Nucleus ReadyStart V3 | before V2017.02.4 | V2017.02.4 | Patch available | CNA |
| Siemens | Nucleus ReadyStart V4 | before V4.1.1 | V4.1.1 | Patch available | CNA |
| Siemens | Nucleus Source Code | All versions | — | No fix listed | CNA |
| Siemens | PLUSCONTROL 1st Gen | All versions | — | No fix listed | CNA |
| Siemens | TALON TC Compact (BACnet) | before V3.5.4 | V3.5.4 | Patch available | CNA |
| Siemens | TALON TC Modular (BACnet) | before V3.5.4 | V3.5.4 | Patch available | CNA |
- APOGEE MBC (PPC) (BACnet) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- APOGEE MBC (PPC) (P2 Ethernet) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- APOGEE MEC (PPC) (BACnet) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- APOGEE MEC (PPC) (P2 Ethernet) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- APOGEE PXC Compact (BACnet) VendorSiemens Affected before V3.5.4 Fixed in V3.5.4 Patch available CNA
- APOGEE PXC Compact (P2 Ethernet) VendorSiemens Affected before V2.8.19 Fixed in V2.8.19 Patch available CNA
- APOGEE PXC Modular (BACnet) VendorSiemens Affected before V3.5.4 Fixed in V3.5.4 Patch available CNA
- APOGEE PXC Modular (P2 Ethernet) VendorSiemens Affected before V2.8.19 Fixed in V2.8.19 Patch available CNA
- Desigo PXC00-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC00-U VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC001-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC100-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC12-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC128-U VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC200-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC22-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC22.1-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC36.1-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC50-E.D VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXC64-U VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Desigo PXM20-E VendorSiemens Affected All versions >= V2.3 and < V6.30.016 Fixed in — No fix listed CNA
- Nucleus NET VendorSiemens Affected All versions Fixed in — No fix listed CNA
- Nucleus ReadyStart V3 VendorSiemens Affected before V2017.02.4 Fixed in V2017.02.4 Patch available CNA
- Nucleus ReadyStart V4 VendorSiemens Affected before V4.1.1 Fixed in V4.1.1 Patch available CNA
- Nucleus Source Code VendorSiemens Affected All versions Fixed in — No fix listed CNA
- PLUSCONTROL 1st Gen VendorSiemens Affected All versions Fixed in — No fix listed CNA
- TALON TC Compact (BACnet) VendorSiemens Affected before V3.5.4 Fixed in V3.5.4 Patch available CNA
- TALON TC Modular (BACnet) VendorSiemens Affected before V3.5.4 Fixed in V3.5.4 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:capital_vstar:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:* | before 2017.02.4 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:nucleus_readystart_v4:*:*:*:*:*:*:*:* | before 4.1.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:nucleus_source_code:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:o:siemens:apogee_modular_building_controller_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:apogee_modular_building_controller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:apogee_modular_equiment_controller_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:apogee_modular_equiment_controller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:apogee_pxc_compact_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
- cpe:2.3:a:siemens:capital_vstar:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:* Versions before 2017.02.4 Vulnerable ·Siemens
- cpe:2.3:a:siemens:nucleus_readystart_v4:*:*:*:*:*:*:*:* Versions before 4.1.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:nucleus_source_code:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:o:siemens:apogee_modular_building_controller_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:apogee_modular_building_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:apogee_modular_equiment_controller_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:apogee_modular_equiment_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:apogee_pxc_compact_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:siemens:apogee_pxc_compact:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:apogee_pxc_modular_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:apogee_pxc_modular:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:talon_tc_compact_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:talon_tc_compact:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:talon_tc_modular_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:talon_tc_modular:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:h:siemens:apogee_pxc_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:apogee_pxc_modular_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:apogee_pxc_modular:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:talon_tc_compact_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:talon_tc_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:talon_tc_modular_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:talon_tc_modular:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA APOGEE PXC Compact (BACnet) (Siemens) Fixed in V3.5.4
- Fix · CNA APOGEE PXC Compact (P2 Ethernet) (Siemens) Fixed in V2.8.19
- Fix · CNA APOGEE PXC Modular (BACnet) (Siemens) Fixed in V3.5.4
- Fix · CNA APOGEE PXC Modular (P2 Ethernet) (Siemens) Fixed in V2.8.19
- Fix · CNA Nucleus ReadyStart V3 (Siemens) Fixed in V2017.02.4
- Fix · CNA Nucleus ReadyStart V4 (Siemens) Fixed in V4.1.1
- Fix · CNA TALON TC Compact (BACnet) (Siemens) Fixed in V3.5.4
- Fix · CNA TALON TC Modular (BACnet) (Siemens) Fixed in V3.5.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-31885
- 2026-10-03 Alias added: GHSA-fc2w-gxv3-9vh5
References
More Siemens Apogee Modular Building Controller Firmware vulnerabilities
- TI-2021-11875 Out-of-bounds write in Siemens APOGEE MBC CVSS 3.1CRITICAL 9.8
- TI-2022-17998 Uncontrolled resource consumption in Siemens APOGEE MBC CVSS 4.0HIGH 8.7
- TI-2021-11873 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE… CVSS 3.1CRITICAL 9.8
- TI-2021-11879 A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All… CVSS 3.1CRITICAL 9.1
- TI-2021-11878 Integer underflow in Siemens Capital Embedded AR Classic 431-422 CVSS 3.1CRITICAL 9.1
- TI-2021-11877 Out-of-bounds write in Siemens APOGEE MBC CVSS 3.1HIGH 8.8
Sources
- CVE-2021-31885 · CVE Program
- CVE-2021-31885 · NVD
- FIRST EPSS
- GHSA-fc2w-gxv3-9vh5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences