Description
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | APOGEE PXC and TALON TC BACnet Automation Controllers All versions <V3.5 | APOGEE PXC and TALON TC BACnet Automation Controllers All versions <V3.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
RoseSecurity/APOLOGEE ★ 50 · May 26, 2022
APOLOGEE is a Python script and Metasploit module that enumerates a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers (all versions prior to V3.5) and TALON TC BACnet Automation Co…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- ICSA-17-285-05 Siemens BACnet Field Panels (Update A) CISA ICS & IT advisories · Jun 14, 2022
- SSA-148078 SSA-148078: Multiple Vulnerabilities in APOGEE/TALON Field Panels Siemens ProductCERT · Jun 14, 2022