All CISA Advisories, EN

Siemens APOGEE, TALON and Desigo PXC/PXM Products

View CSAF

Summary

The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.

The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected:

  • APOGEE MBC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • APOGEE MBC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • APOGEE MEC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • APOGEE PXC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • APOGEE PXC Compact (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • APOGEE PXC Modular (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • APOGEE PXC Modular (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • Desigo PXC00-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC00-U vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC001-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC100-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC12-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC128-U vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC200-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC22-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC22.1-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC36.1-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC50-E.D vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXC64-U vers:intdot/>=2.3 (CVE-2026-89208)
  • Desigo PXM20-E vers:intdot/>=2.3 (CVE-2026-89208)
  • TALON TC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
  • TALON TC Modular (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)

CVSS
Vendor
Equipment

v3 8.2
Siemens
APOGEE MBC (PPC) (BACnet)

3 Vulnerabilities

Out-of-bounds Read, Integer Underflow (Wrap or Wraparound), Stack-based Buffer Overflow

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities
Expand All +

CVE-2026-89208
The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.
Read More

13 Affected Products

Desigo PXC00-U >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC001-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC100-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC12-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC128-U >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC200-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC22-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC22.1-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
 CVE-2026-89208 – Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is

[…]
Content was trimmed to protect the source. Please visit the original article for the full text.

This article has been indexed from All CISA Advisories