Description
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | APOGEE PXC Compact (BACnet) | All versions < V3.5.5 | — |
| Siemens | APOGEE PXC Compact (P2 Ethernet) | All versions < V2.8.20 | — |
| Siemens | APOGEE PXC Modular (BACnet) | All versions < V3.5.5 | — |
| Siemens | APOGEE PXC Modular (P2 Ethernet) | All versions < V2.8.20 | — |
| Siemens | TALON TC Compact (BACnet) | All versions < V3.5.5 | — |
| Siemens | TALON TC Modular (BACnet) | All versions < V3.5.5 | — |
Advisories 2
- ICSA-22-349-16 Siemens APOGEE and TALON CISA ICS & IT advisories · May 6, 2025
- SSA-180579 SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 Siemens ProductCERT · Aug 8, 2023