CVE-2026-102076: High severity Siemens APOGEE MBC (PPC) (BACnet) vulnerability
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
APOGEE PXC Compact (BACnet), APOGEE PXC Modular (BACnet), TALON TC Compact (BACnet), TALON TC Modular (BACnet)to a version that resolves this vulnerability.Fixed in V3.5.7 - Upgrade
Upgrade
APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (P2 Ethernet)to a version that resolves this vulnerability.Fixed in V2.8.21
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction. The affected web service must be reachable by the attacker.
Which versions require attention?
All versions of APOGEE MBC (PPC) and APOGEE MEC (PPC), for both BACnet and P2 Ethernet, are affected. APOGEE PXC Compact and PXC Modular BACnet versions earlier than V3.5.7, P2 Ethernet versions earlier than V2.8.21, and TALON TC Compact and Modular BACnet versions earlier than V3.5.7 are affected.