CVE-2026-102073

Unvalidated Input in Siemens APOGEE Web Service Enables Unauthenticated Remote Memory Read or Denial of Service

Published Oct 13, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Siemens

APOGEE MBC (PPC) (BACnet)

unknown

Version	Status	Constraints
`0`	affected	< *

Siemens

APOGEE MBC (PPC) (P2 Ethernet)

unknown

Version	Status	Constraints
`0`	affected	< *

Siemens

APOGEE MEC (PPC) (BACnet)

unknown

Version	Status	Constraints
`0`	affected	< *

Siemens

APOGEE MEC (PPC) (P2 Ethernet)

unknown

Version	Status	Constraints
`0`	affected	< *

Siemens

APOGEE PXC Compact (BACnet)

unknown

Version	Status	Constraints
`0`	affected	< V3.5.7

Siemens

APOGEE PXC Compact (P2 Ethernet)

unknown

Version	Status	Constraints
`0`	affected	< V2.8.21

Siemens

APOGEE PXC Modular (BACnet)

unknown

Version	Status	Constraints
`0`	affected	< V3.5.7

Siemens

APOGEE PXC Modular (P2 Ethernet)

unknown

Version	Status	Constraints
`0`	affected	< V2.8.21

Siemens

TALON TC Compact (BACnet)

unknown

Version	Status	Constraints
`0`	affected	< V3.5.7

Siemens

TALON TC Modular (BACnet)

unknown

Version	Status	Constraints
`0`	affected	< V3.5.7

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.345% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-333035.html

History

Oct 14, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 13, 2026 11:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unvalidated Input in Siemens APOGEE Web Service Enables Unauthenticated Remote Memory Read or Denial of Service

Oct 13, 2026 9:45 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.
Weaknesses		CWE-191
References		https://cert-portal.siemens.com/productcert/html/ssa-333035.html
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N'}`