CVE-2021-27391: Buffer Overflow

First published: Tue Sep 14 2021(Updated: )

A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.

Credit: productcert@siemens.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• collector/mitre-cve
• source/MITRE
• agent/references
• agent/severity
• agent/author
• agent/last-modified-date
• agent/remedy
• agent/weakness
• agent/description
• agent/first-publish-date
• agent/event
• agent/source
• agent/tags
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/softwarecombine
• vendor/siemens
• canonical/siemens apogee mbc (ppc) (p2 ethernet) firmware
• version/siemens apogee mbc (ppc) (p2 ethernet) firmware/2.6.3
• canonical/siemens apogee mbc (ppc) (p2 ethernet)
• canonical/siemens apogee mec (ppc) (p2 ethernet) firmware
• version/siemens apogee mec (ppc) (p2 ethernet) firmware/2.6.3
• canonical/siemens apogee mec (ppc) (p2 ethernet)
• canonical/siemens apogee pxc modular (bacnet) firmware
• canonical/siemens apogee pxc bacnet automation controller firmware
• canonical/siemens apogee pxc compact (p2 ethernet) firmware
• version/siemens apogee pxc compact (p2 ethernet) firmware/2.8
• canonical/siemens apogee pxc compact (p2 ethernet)
• canonical/siemens apogee pxc modular (bacnet)
• canonical/siemens apogee pxc modular (p2 ethernet) firmware
• version/siemens apogee pxc modular (p2 ethernet) firmware/2.8
• canonical/siemens apogee pxc modular (p2 ethernet)
• canonical/siemens talon tc compact (bacnet) firmware
• canonical/siemens talon tc compact (bacnet)
• canonical/siemens talon tc modular (bacnet) firmware
• canonical/siemens talon tc modular (bacnet)