CVE-2026-102073

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-15
Weakness: CWE-191

Description

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.

Affected products

Siemens APOGEE MBC (PPC) (BACnet): all versions
Siemens APOGEE MBC (PPC) (P2 Ethernet): all versions
Siemens APOGEE MEC (PPC) (BACnet): all versions
Siemens APOGEE MEC (PPC) (P2 Ethernet): all versions
Siemens APOGEE PXC Compact (BACnet): before V3.5.7 — fixed in V3.5.7
Siemens APOGEE PXC Compact (P2 Ethernet): before V2.8.21 — fixed in V2.8.21
Siemens APOGEE PXC Modular (BACnet): before V3.5.7 — fixed in V3.5.7
Siemens APOGEE PXC Modular (P2 Ethernet): before V2.8.21 — fixed in V2.8.21
Siemens TALON TC Compact (BACnet): before V3.5.7 — fixed in V3.5.7
Siemens TALON TC Modular (BACnet): before V3.5.7 — fixed in V3.5.7

How to fix

Upgrade to a fixed version: Siemens APOGEE PXC Compact (BACnet) V3.5.7; Siemens APOGEE PXC Compact (P2 Ethernet) V2.8.21; Siemens APOGEE PXC Modular (BACnet) V3.5.7; Siemens APOGEE PXC Modular (P2 Ethernet) V2.8.21; Siemens TALON TC Compact (BACnet) V3.5.7; Siemens TALON TC Modular (BACnet) V3.5.7. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-333035.html

Get alerted when CVE-2026-102073 or the next vulnerability affects your stack