CVE-2026-102073: Siemens APOGEE/TALON Building Automation Web Service Flaw (pending)

Checked: 2026-10-27

Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-102073 is an input-length validation flaw in the web service of Siemens APOGEE and TALON building-automation controllers that lets an unauthenticated remote attacker read portions of device memory or cause a denial of service; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.

Vulnerability summary

Vulnerability ID	CVE-2026-102073
CVSS score	Not yet scored by NVD
EPSS score	0.00345
CISA KEV	No
Source	NVD
Published	2026-10-13T10:17:14.157

Affected components

Component	CPE	Version range
Siemens APOGEE MBC/MEC (PPC) and PXC Compact/Modular; TALON TC Compact/Modular	—	APOGEE MBC/MEC (PPC), all versions, no fix planned; APOGEE PXC Compact/Modular (BACnet) before V3.5.7 and (P2 Ethernet) before V2.8.21; TALON TC Compact/Modular (BACnet) before V3.5.7 — fixed in the stated versions; not yet a published NVD CPE applicability statement

What this means

CVE-2026-102073 is an out-of-bounds-style memory-disclosure/denial-of-service flaw (CWE-191, integer underflow) in the web service of Siemens APOGEE and TALON building automation controllers. NVD's description, sourced from the Siemens ProductCERT submission, states the affected web service "does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition," and lists the affected product lines as APOGEE MBC (PPC) and MEC (PPC) in both BACnet and P2 Ethernet variants (all versions), APOGEE PXC Compact/Modular (BACnet, before V3.5.7; P2 Ethernet, before V2.8.21), and TALON TC Compact/Modular (BACnet, before V3.5.7) (NVD).

NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-15: it records a CNA-submitted (Siemens ProductCERT) CVSS v3.1 score of 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, and a CVSS v4.0 score of 8.8 (high), but NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the CNA figure as NVD-confirmed (NVD).

CISA's ICS advisory ICSA-26-295-08, published 2026-10-22, bundles this CVE with four further flaws in the same Siemens APOGEE/TALON/Desigo PXC/PXM product family disclosure (SSA-333035), including three stack-based buffer overflows (CWE-121, CVSS 7.5). CISA states the products "contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device," and recommends network segmentation behind properly configured gateways/firewalls and disabling the FTP/Web service where not required — noting it is disabled by default on APOGEE, Desigo and TALON products. TALON TC and APOGEE PXC models are fixed in BACnet V3.5.7 or P2 Ethernet V2.8.21; APOGEE MBC/MEC (PPC) and all Desigo models affected by the bundled CVEs have "no fix planned." Siemens ProductCERT is credited with the report (CISA ICS Advisory ICSA-26-295-08).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00345 (27.912th percentile) as of 2026-10-27 (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators of affected APOGEE and TALON controllers should apply the available firmware updates where a fix exists, disable the FTP/Web service if not required, and place these building-automation controllers behind network segmentation consistent with Siemens' and CISA's guidance.

How to fix this class of issueThis advisory's weakness class is Memory corruption. Our practical guide covers how to detect, fix, verify and disclose it: How to fix memory corruption in embedded firmware.

Evidence

The web service fails to validate the length of user-controllable input, letting an unauthenticated remote attacker read device memory or cause a denial-of-service condition (CWE-191). — NVD
NVD status is "Awaiting Analysis" with a CNA (Siemens ProductCERT) submitted CVSS v3.1 8.2 / v4.0 8.8; no NVD-published score or CPE configuration as of 2026-10-15. — NVD
Bundled with four further APOGEE/TALON/Desigo flaws from Siemens SSA-333035 (including three stack buffer overflows); TALON TC/APOGEE PXC fixed in V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet); APOGEE MBC/MEC and Desigo have no fix planned; mitigation is network segmentation and disabling the FTP/Web service. — CISA ICS Advisory ICSA-26-295-08
Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
EPSS score is 0.00345 (27.912th percentile) as of 2026-10-27. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2025-62593: Ray AI Compute Engine Browser-to-RCE via DNS Rebinding (KEV)CVE-2025-62593: KEV code injection in Ray lets an attacker combine DNS rebinding with a Firefox/Safari User-Agent spoof to reach a developer's local Ray dashboard and run arbitrary code. Sourced to NVD, CISA and Ray-Project.