Skip to content
OpenAdvisories
High SSA-935500 1 CVE

SSA-935500: Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products

Published Oct 11, 2022 · Updated May 13, 2025 · Revision 4

Vendor: Siemens Product: APOGEE MBC (PPC) (BACnet) Product: APOGEE MBC (PPC) (P2 Ethernet) Product: APOGEE MEC (PPC) (BACnet) Product: APOGEE MEC (PPC) (P2 Ethernet) Product: APOGEE PXC Compact (BACnet) Product: APOGEE PXC Compact (P2 Ethernet) Product: APOGEE PXC Modular (BACnet) Product: APOGEE PXC Modular (P2 Ethernet) Product: Desigo PXC00-E.D Product: Desigo PXC00-U Product: Desigo PXC001-E.D Product: Desigo PXC100-E.D Product: Desigo PXC12-E.D Product: Desigo PXC128-U Product: Desigo PXC200-E.D Product: Desigo PXC22-E.D Product: Desigo PXC22.1-E.D Product: Desigo PXC36.1-E.D Product: Desigo PXC50-E.D Product: Desigo PXC64-U Product: Desigo PXM20-E Product: TALON TC Compact (BACnet) Product: TALON TC Modular (BACnet)

Summary

A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313:
https://cert-portal.siemens.com/productcert/html/ssa-313313.html.
The products listed below use affected versions of the Nucleus software and inherently contain the vulnerability.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #4

    Added download link for Desigo PXC/PXM devices

  2. #3

    Added fix for Desigo PXC/PXM devices

  3. #2

    Added fix for APOGEE PXC Series (BACnet), APOGEE PXC Series (P2 Ethernet), TALON TC Series (BACnet); added CVSSv4.0 vector and score

  4. #1

    Publication Date

References