Siemens APOGEE/TALON/Desigo Multiple Vulnerabilities and Patch

Vulnerability Overview Siemens has released updates regarding multiple security vulnerabilities affecting APOGEE, TALON, and Desigo PXC/PXM products. These vulnerabilities could lead to denial of service and impact device availability. Affected Products APOGEE MBC (PPC) (BACnet) APOGEE MBC (PPC) (P2 Ethernet) APOGEE MEC (PPC) (BACnet) APOGEE MEC (PPC) (P2 Ethernet) APOGEE PXC Compact (BACnet) APOGEE PXC Compact (P2 Ethernet) APOGEE PXC Modular (BACnet) APOGEE PXC Modular (P2 Ethernet) Desigo PXC00-E.D Desigo PXC00-U Desigo PXC01-E.D Desigo PXC12-E.D Desigo PXC22-E.D Desigo PXC22.1 E.D Desigo PXC36.1 E.D Desigo PXC50-E.D Desigo PXC64-U Desigo PXC100-E.D Desigo PXC126-U Desigo PXC200-E.D Desigo PXM20-E TALON TC Compact (BACnet) TALON TC Modular (BACnet) Remediation APOGEE PXC Compact (BACnet) - Update to version V3.5.7 or later - Link: https://support.industry.siemens.com APOGEE PXC Compact (P2 Ethernet) - Update to version V2.8.21 or later - Link: https://support.industry.siemens.com APOGEE PXC Modular (BACnet) - Update to version V3.5.7 or later - Link: https://support.industry.siemens.com APOGEE PXC Modular (P2 Ethernet) - Update to version V2.8.21 or later - Link: https://support.industry.siemens.com TALON TC Compact (BACnet) - Update to version V3.5.7 or later - Link: https://support.industry.siemens.com TALON TC Modular (BACnet) - Update to version V3.5.7 or later - Link: https://support.industry.siemens.com Mitigation Measures CVE-2026-102073 - Disable FTP/Web services (disabled by default on APOGEE, Desigo, and TALON products) CVE-2026-102074 - Disable FTP/Web services (disabled by default on APOGEE, Desigo, and TALON products) CVE-2026-102075 - Disable FTP/Web services (disabled by default on APOGEE, Desigo, and TALON products) CVE-2026-102076 - Disable FTP/Web services (disabled by default on APOGEE, Desigo, and TALON products) CVE-2026-89208 - Implement network segmentation and place controllers behind a properly configured gateway/firewall General Security Recommendations Protect network access using appropriate mechanisms. Follow recommended security practices and operate devices in protected environments. Vulnerability Description CVE-2026-89208 - Improper validation of input boundaries, which may lead to out-of-bounds memory read. CVE-2026-102073 - Improper validation of user-controlled input length, which may lead to denial of service. CVE-2026-102074 - Improper validation of user-controlled input length, which may lead to denial of service. CVE-2026-102075 - Improper validation of user input in multipart processing, which may lead to denial of service. CVE-2026-102076 - Improper validation of user-provided input in uploaded code, which may lead to denial of service. Acknowledgments Thanks to Stanislav Dashevskiy and Francesco La Spina for their contributions to coordinated disclosure. Additional Information For inquiries regarding other security vulnerabilities in Siemens products and solutions, please contact Siemens ProductCERT: https://www.siemens.com/cert/advisories History V1.0 (2026-10-13): Release Date Terms of Use Siemens security advisories are subject to the terms and conditions listed at https://www.siemens.com/productcert/terms-of-use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens APOGEE/TALON/Desigo Multiple Vulnerabilities and Patch