CVE-2026-102073: Siemens APOGEE PXC/MBC/MEC input validation in web service

CVE-2026-102073 · Severity: high · CVSS 8.2 · Published 2026-10-13

Siemens APOGEE, TALON, and related building automation controllers contain a web service that fails to validate user input properly, allowing unauthenticated attackers to read device memory or cause service outages. This could lead to exposure of sensitive configuration data or disruption of climate control and facility management systems in commercial buildings.

Technologies: Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet), Siemens APOGEE MEC (PPC) (P2 Ethernet), Siemens APOGEE PXC Compact (BACnet), Siemens APOGEE PXC Compact (P2 Ethernet), Siemens APOGEE PXC Modular (BACnet), Siemens APOGEE PXC Modular (P2 Ethernet), Siemens TALON TC Compact (BACnet), Siemens TALON TC Modular (BACnet). Vendors: Siemens.

Quick answers

Is CVE-2026-102073 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102073 being exploited in the wild.
How severe is CVE-2026-102073?
High severity, with a CVSS score of 8.2, published 13 October 2026.
Which products and versions are affected?
Siemens APOGEE MBC (PPC) (BACnet) all versions; Siemens APOGEE MBC (PPC) (P2 Ethernet) all versions; Siemens APOGEE MEC (PPC) (BACnet) all versions; Siemens APOGEE MEC (PPC) (P2 Ethernet) all versions; and 6 more.
Is there a fix for CVE-2026-102073?
Yes: fixed in APOGEE PXC Compact BACnet V3.5.7, APOGEE PXC Compact P2 Ethernet V2.8.21, APOGEE PXC Modular BACnet V3.5.7, APOGEE PXC Modular P2 Ethernet V2.8.21, TALON TC Compact V3.5.7, TALON TC Modular V3.5.7. Until then: Disable the FTP/Web service on affected devices (note that this service is disabled by default on APOGEE, Desigo, and TALON products, so enable it only if operationally necessary). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102073 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-102073?
Check whether you run Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: APOGEE PXC Compact BACnet V3.5.7, APOGEE PXC Compact P2 Ethernet V2.8.21, APOGEE PXC Modular BACnet V3.5.7, APOGEE PXC Modular P2 Ethernet V2.8.21, TALON TC Compact V3.5.7, TALON TC Modular V3.5.7

Disable the FTP/Web service on affected devices (note that this service is disabled by default on APOGEE, Desigo, and TALON products, so enable it only if operationally necessary).

Technical details

The web service in affected building automation controllers does not properly validate the length of user-supplied input, allowing an unauthenticated remote attacker to trigger memory disclosure or denial-of-service conditions. The vulnerability is reachable over the network without authentication. A fix is available for APOGEE PXC Compact/Modular and TALON TC models, but MBC and MEC variants have no planned remediation.

Affected products

  • Siemens APOGEE MBC (PPC) BACnet all versions
  • Siemens APOGEE MBC (PPC) P2 Ethernet all versions
  • Siemens APOGEE MEC (PPC) BACnet all versions
  • Siemens APOGEE MEC (PPC) P2 Ethernet all versions
  • Siemens APOGEE PXC Compact BACnet all versions < V3.5.7
  • Siemens APOGEE PXC Compact P2 Ethernet all versions < V2.8.21
  • Siemens APOGEE PXC Modular BACnet all versions < V3.5.7
  • Siemens APOGEE PXC Modular P2 Ethernet all versions < V2.8.21
  • Siemens TALON TC Compact BACnet all versions < V3.5.7
  • Siemens TALON TC Modular BACnet all versions < V3.5.7

Identifiers

  • CVE-2026-102073
  • CVE-2026-102075
  • CVE-2026-102076
  • CVE-2026-102074
  • CVE-2026-89208

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.