Skip to content
OpenAdvisories
High SSA-162506 1 CVE

SSA-162506: DHCP Client Vulnerability in SIMOTICS CONNECT 400, Desigo PXC/PXM, APOGEE MEC/MBC/PXC, APOGEE PXC Series, and TALON TC Series

Published Apr 14, 2020 · Updated Jun 10, 2025 · Revision 5

Vendor: Siemens Product: APOGEE MEC/MBC/PXC (P2) Product: APOGEE PXC Compact (BACnet) Product: APOGEE PXC Compact (P2 Ethernet) Product: APOGEE PXC Modular (BACnet) Product: APOGEE PXC Modular (P2 Ethernet) Product: Desigo PXC00-E.D Product: Desigo PXC00-U Product: Desigo PXC001-E.D Product: Desigo PXC100-E.D Product: Desigo PXC12-E.D Product: Desigo PXC128-U Product: Desigo PXC200-E.D Product: Desigo PXC22-E.D Product: Desigo PXC22.1-E.D Product: Desigo PXC36.1-E.D Product: Desigo PXC50-E.D Product: Desigo PXC64-U Product: Desigo PXM20-E Product: SIMOTICS CONNECT 400 Product: TALON TC Compact (BACnet) Product: TALON TC Modular (BACnet)

Summary

SIMOTICS CONNECT 400, Desigo (Power PC-based), APOGEE MEC/MBC/PXC and TALON TC products are affected by a DHCP Client vulnerability as initially reported in
SSA-434032 for the Mentor Nucleus Networking Module.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #5

    CVE-2019-13939: Added CVSSv4.0 vector and changed CWE from CWE-840 to CWE-20

  2. #4

    Added solution for APOGEE PXC Series (P2)

  3. #3

    Listed all affected Desigo PXC and PXM20 products explicitly. Added solution for APOGEE PXC Series (BACnet) and TALON TC Series (BACnet)

  4. #2

    Added solution for Desigo PXC and PXM20

  5. #1

    Publication Date

References