Skip to content
OpenAdvisories
High ICSA-22-349-16 8 CVEs

Siemens APOGEE and TALON

Published Dec 13, 2022 · Updated May 6, 2025 · Revision 3

Vendor: Siemens Product: APOGEE PXC Compact (BACnet) Product: APOGEE PXC Compact (P2 Ethernet) Product: APOGEE PXC Modular (BACnet) Product: APOGEE PXC Modular (P2 Ethernet) Product: TALON TC Compact (BACnet) Product: TALON TC Modular (BACnet)

Summary

APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities:

- CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access.
- CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products.
- Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 8

Revision history

  1. #3

    Revision - Fixing typos

  2. #2

    Added additional vulnerabilities that were fixed in the same product versions (V3.5.5 / V2.8.20)

  3. #1

    Publication Date

References