CVE-2026-102073: Integer Underflow
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
APOGEE PXC Compact (BACnet), APOGEE PXC Modular (BACnet), TALON TC Compact (BACnet), TALON TC Modular (BACnet)to a version that resolves this vulnerability.Fixed in V3.5.7 - Upgrade
Upgrade
APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (P2 Ethernet)to a version that resolves this vulnerability.Fixed in V2.8.21
Event History
Frequently Asked Questions
Which systems remain affected regardless of software version?
All versions of APOGEE MBC (PPC) for BACnet and P2 Ethernet, and APOGEE MEC (PPC) for BACnet and P2 Ethernet, are affected. For the listed PXC and TALON products, exposure depends on whether the installed version is below the stated fixed version.
What access does an attacker need to exploit this issue?
An attacker can exploit the affected web service remotely without authentication or user interaction. The available attack vector is network-based.
What could successful exploitation allow?
Successful exploitation could let an attacker read portions of device memory or cause a denial-of-service condition. The described impact does not state that the attacker can modify device data or execute code.
Which versions of the PXC and TALON products are affected?
APOGEE PXC Compact and PXC Modular BACnet, plus TALON TC Compact and TC Modular BACnet, are affected below V3.5.7. APOGEE PXC Compact and PXC Modular P2 Ethernet are affected below V2.8.21.