Read the docs
TI-2026-71599 Aliases CVE-2026-102073GHSA-3jcw-mhf3-39cw

Missing input length validation in Siemens APOGEE and TALON devices

Priority MEDIUM 44CWE-191Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Siemens APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet) and other products are affected. All versions of the APOGEE MBC and MEC products are affected, as are versions before V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet) of the PXC Compact, PXC Modular and TALON TC products. The web service does not validate the length of user-controllable input, causing an integer underflow (CWE-191). An unauthenticated remote attacker can read portions of device memory or cause a denial-of-service condition.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Fixed APOGEE PXC Compact (BACnet) (Siemens): V3.5.7APOGEE PXC Compact (P2 Ethernet) (Siemens): V2.8.21+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensAPOGEE MBC (PPC) (BACnet)all versions—No fix listedCNA
SiemensAPOGEE MBC (PPC) (P2 Ethernet)all versions—No fix listedCNA
SiemensAPOGEE MEC (PPC) (BACnet)all versions—No fix listedCNA
SiemensAPOGEE MEC (PPC) (P2 Ethernet)all versions—No fix listedCNA
SiemensAPOGEE PXC Compact (BACnet)before V3.5.7V3.5.7Patch availableCNA
SiemensAPOGEE PXC Compact (P2 Ethernet)before V2.8.21V2.8.21Patch availableCNA
SiemensAPOGEE PXC Modular (BACnet)before V3.5.7V3.5.7Patch availableCNA
SiemensAPOGEE PXC Modular (P2 Ethernet)before V2.8.21V2.8.21Patch availableCNA
SiemensTALON TC Compact (BACnet)before V3.5.7V3.5.7Patch availableCNA
SiemensTALON TC Modular (BACnet)before V3.5.7V3.5.7Patch availableCNA
  • APOGEE MBC (PPC) (BACnet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE MBC (PPC) (P2 Ethernet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE MEC (PPC) (BACnet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE MEC (PPC) (P2 Ethernet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE PXC Compact (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA
  • APOGEE PXC Compact (P2 Ethernet) VendorSiemens Affected before V2.8.21 Fixed in V2.8.21 Patch available CNA
  • APOGEE PXC Modular (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA
  • APOGEE PXC Modular (P2 Ethernet) VendorSiemens Affected before V2.8.21 Fixed in V2.8.21 Patch available CNA
  • TALON TC Compact (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA
  • TALON TC Modular (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA

Remediation

Update APOGEE PXC Compact and Modular (BACnet) and TALON TC Compact and Modular (BACnet) to V3.5.7, and APOGEE PXC Compact and Modular (P2 Ethernet) to V2.8.21. No fixed version is listed for APOGEE MBC (PPC) or APOGEE MEC (PPC).

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA APOGEE PXC Compact (BACnet) (Siemens) Fixed in V3.5.7
  • Fix · CNA APOGEE PXC Compact (P2 Ethernet) (Siemens) Fixed in V2.8.21
  • Fix · CNA APOGEE PXC Modular (BACnet) (Siemens) Fixed in V3.5.7
  • Fix · CNA APOGEE PXC Modular (P2 Ethernet) (Siemens) Fixed in V2.8.21
  • Fix · CNA TALON TC Compact (BACnet) (Siemens) Fixed in V3.5.7
  • Fix · CNA TALON TC Modular (BACnet) (Siemens) Fixed in V3.5.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet) and 4 more products V2.8.21, V3.5.7

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2026-71602 Improper input validation in Siemens APOGEE and TALON upload codePriority MEDIUM 44
    • TI-2026-71601 Denial of service in Siemens APOGEE and TALON web servicePriority MEDIUM 44
    • TI-2026-71600 Stack-based buffer overflow in Siemens APOGEE and TALON FTP servicePriority MEDIUM 44
    Show all 4 records →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-102073
  2. 2026-10-13 Alias added: GHSA-3jcw-mhf3-39cw
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-15 CISA SSVC decision points changed
  5. 2026-10-15 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences