Description
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | APOGEE PXC Compact (BACnet) | All versions < V3.5.5 | — |
| Siemens | APOGEE PXC Compact (P2 Ethernet) | All versions < V2.8.20 | — |
| Siemens | APOGEE PXC Modular (BACnet) | All versions < V3.5.5 | — |
| Siemens | APOGEE PXC Modular (P2 Ethernet) | All versions < V2.8.20 | — |
| Siemens | Nucleus NET | All versions < V5.2 | — |
| Siemens | Nucleus ReadyStart V3 | All versions < V2012.12 | — |
| Siemens | Nucleus Source Code | All versions | — |
| Siemens | PLUSCONTROL 1st Gen | All versions | — |
| Siemens | TALON TC Compact (BACnet) | All versions < V3.5.5 | — |
| Siemens | TALON TC Modular (BACnet) | All versions < V3.5.5 | — |
Advisories 7
- ICSA-22-349-16 Siemens APOGEE and TALON CISA ICS & IT advisories · May 6, 2025
- SSA-180579 SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 Siemens ProductCERT · Aug 8, 2023
- WID-SEC-2023-1987 TCP/IP Stack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 7, 2023
- SSA-436469 SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels Siemens ProductCERT · Dec 13, 2022
- SSA-362164 SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS Siemens ProductCERT · Nov 8, 2022
- ICSA-21-042-01 Multiple Embedded TCP/IP Stacks (Update B) CISA ICS & IT advisories · Nov 11, 2021
- ICSA-21-068-08 Siemens Energy PLUSCONTROL 1st Gen CISA ICS & IT advisories · Mar 9, 2021