CVE-2026-102074: High severity Siemens APOGEE MBC (PPC) (BACnet) vulnerability
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
APOGEE PXC Compact (BACnet); APOGEE PXC Modular (BACnet); TALON TC Compact (BACnet); TALON TC Modular (BACnet)to a version that resolves this vulnerability.Fixed in V3.5.7 - Upgrade
Upgrade
APOGEE PXC Compact (P2 Ethernet); APOGEE PXC Modular (P2 Ethernet)to a version that resolves this vulnerability.Fixed in V2.8.21
Event History
Frequently Asked Questions
Which deployments are affected regardless of version, and which have version cutoffs?
All versions of APOGEE MBC (PPC) BACnet and P2 Ethernet, and APOGEE MEC (PPC) BACnet and P2 Ethernet, are affected. APOGEE PXC Compact and Modular BACnet, plus TALON TC Compact and Modular BACnet, are affected below V3.5.7; APOGEE PXC Compact and Modular P2 Ethernet are affected below V2.8.21.
What access does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction. The vulnerable interface is the affected product's FTP service.
What is the expected impact of exploitation?
Successful exploitation can cause a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
What can be done if updates cannot be applied immediately?
The provided information identifies the FTP service as the exposed component, but does not specify mitigations. Restricting access to that service is not stated as an official workaround in the available data.