CVE-2022-45937

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-13 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.

Affected products

Siemens Pxc00-E96.A Firmware: before 3.5.5 — fixed in 3.5.5
Siemens Pxc100-E96.A Firmware: before 3.5.5 — fixed in 3.5.5
Siemens Pxc16.2-Pe.A Firmware: before 2.8.20 — fixed in 2.8.20
Siemens Pxc24.2-Pe.A Firmware: before 2.8.20 — fixed in 2.8.20
Siemens Pxc24.2-Pef.A Firmware: before 2.8.20 — fixed in 2.8.20
Siemens Pxc24.2-Per.A Firmware: before 2.8.20 — fixed in 2.8.20
Siemens Pxc24.2-Perf.A Firmware: before 2.8.20 — fixed in 2.8.20
Siemens Pxx-485.3 Firmware: before 3.5.5 — fixed in 3.5.5
Siemens Talon Tc Modular (Bacnet) Firmware: before 3.5.5 — fixed in 3.5.5

How to fix

Upgrade to a fixed version: Siemens Pxc00-E96.A Firmware 3.5.5; Siemens Pxc100-E96.A Firmware 3.5.5; Siemens Pxc16.2-Pe.A Firmware 2.8.20; Siemens Pxc24.2-Pe.A Firmware 2.8.20; Siemens Pxc24.2-Pef.A Firmware 2.8.20; Siemens Pxc24.2-Per.A Firmware 2.8.20; Siemens Pxc24.2-Perf.A Firmware 2.8.20; Siemens Pxx-485.3 Firmware 3.5.5; Siemens Talon Tc Modular (Bacnet) Firmware 3.5.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-45937 or the next vulnerability affects your stack