CVE-2026-102075: High severity Siemens APOGEE MBC (PPC) (BACnet) vulnerability
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
APOGEE PXC Compact (BACnet), APOGEE PXC Modular (BACnet), TALON TC Compact (BACnet), TALON TC Modular (BACnet)to a version that resolves this vulnerability.Fixed in V3.5.7 - Upgrade
Upgrade
APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (P2 Ethernet)to a version that resolves this vulnerability.Fixed in V2.8.21
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
All versions of APOGEE MBC (PPC) and APOGEE MEC (PPC), in both BACnet and P2 Ethernet variants, are affected. APOGEE PXC Compact, PXC Modular, and TALON TC Compact and Modular BACnet variants are affected below V3.5.7; PXC Compact and Modular P2 Ethernet variants are affected below V2.8.21.
Does exploitation require credentials or user interaction?
No. The issue can be exploited remotely by an unauthenticated attacker, and no user interaction is required.
What access would an attacker need to cause an outage?
The attacker needs network access to the affected product's web service. The documented impact is denial of service through malformed multipart input handling.