Read the docs
TI-2026-71600 Aliases CVE-2026-102074GHSA-p6cj-9q95-w4h2

Stack-based buffer overflow in Siemens APOGEE and TALON FTP service

Priority MEDIUM 44CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Siemens APOGEE PXC Compact and Modular and TALON TC Compact and Modular controllers are affected before V3.5.7 (BACnet) or before V2.8.21 (P2 Ethernet), and all versions of APOGEE MBC (PPC) and APOGEE MEC (PPC) are affected. The FTP service does not validate the length of user-controllable input, which causes a stack-based buffer overflow (CWE-121). An unauthenticated remote attacker can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed APOGEE PXC Compact (BACnet) (Siemens): V3.5.7APOGEE PXC Compact (P2 Ethernet) (Siemens): V2.8.21+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensAPOGEE MBC (PPC) (BACnet)all versions—No fix listedCNA
SiemensAPOGEE MBC (PPC) (P2 Ethernet)all versions—No fix listedCNA
SiemensAPOGEE MEC (PPC) (BACnet)all versions—No fix listedCNA
SiemensAPOGEE MEC (PPC) (P2 Ethernet)all versions—No fix listedCNA
SiemensAPOGEE PXC Compact (BACnet)before V3.5.7V3.5.7Patch availableCNA
SiemensAPOGEE PXC Compact (P2 Ethernet)before V2.8.21V2.8.21Patch availableCNA
SiemensAPOGEE PXC Modular (BACnet)before V3.5.7V3.5.7Patch availableCNA
SiemensAPOGEE PXC Modular (P2 Ethernet)before V2.8.21V2.8.21Patch availableCNA
SiemensTALON TC Compact (BACnet)before V3.5.7V3.5.7Patch availableCNA
SiemensTALON TC Modular (BACnet)before V3.5.7V3.5.7Patch availableCNA
  • APOGEE MBC (PPC) (BACnet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE MBC (PPC) (P2 Ethernet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE MEC (PPC) (BACnet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE MEC (PPC) (P2 Ethernet) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • APOGEE PXC Compact (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA
  • APOGEE PXC Compact (P2 Ethernet) VendorSiemens Affected before V2.8.21 Fixed in V2.8.21 Patch available CNA
  • APOGEE PXC Modular (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA
  • APOGEE PXC Modular (P2 Ethernet) VendorSiemens Affected before V2.8.21 Fixed in V2.8.21 Patch available CNA
  • TALON TC Compact (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA
  • TALON TC Modular (BACnet) VendorSiemens Affected before V3.5.7 Fixed in V3.5.7 Patch available CNA

Remediation

Fixed versions are V3.5.7 for APOGEE PXC Compact (BACnet), APOGEE PXC Modular (BACnet), TALON TC Compact (BACnet) and TALON TC Modular (BACnet), and V2.8.21 for APOGEE PXC Compact (P2 Ethernet) and APOGEE PXC Modular (P2 Ethernet). The sources list no fixed version for APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet) or APOGEE MEC (PPC) (P2 Ethernet).

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA APOGEE PXC Compact (BACnet) (Siemens) Fixed in V3.5.7
  • Fix · CNA APOGEE PXC Compact (P2 Ethernet) (Siemens) Fixed in V2.8.21
  • Fix · CNA APOGEE PXC Modular (BACnet) (Siemens) Fixed in V3.5.7
  • Fix · CNA APOGEE PXC Modular (P2 Ethernet) (Siemens) Fixed in V2.8.21
  • Fix · CNA TALON TC Compact (BACnet) (Siemens) Fixed in V3.5.7
  • Fix · CNA TALON TC Modular (BACnet) (Siemens) Fixed in V3.5.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet) and 4 more products V2.8.21, V3.5.7

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2026-71602 Improper input validation in Siemens APOGEE and TALON upload codePriority MEDIUM 44
    • TI-2026-71601 Denial of service in Siemens APOGEE and TALON web servicePriority MEDIUM 44
    • TI-2026-71599 Missing input length validation in Siemens APOGEE and TALON devicesPriority MEDIUM 44
    Show all 4 records →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-102074
  2. 2026-10-13 Alias added: GHSA-p6cj-9q95-w4h2
  3. 2026-10-13 CISA SSVC decision points changed

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences