attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high.
Affected products
see table below
Classified as
CWE-121 (Stack-based Buffer Overflow)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Siemens
APOGEE MBC (PPC) (BACnet)
Siemens
APOGEE MBC (PPC) (P2 Ethernet)
Siemens
APOGEE MEC (PPC) (BACnet)
Siemens
APOGEE MEC (PPC) (P2 Ethernet)
Siemens
APOGEE PXC Compact (BACnet)
Siemens
APOGEE PXC Compact (P2 Ethernet)
Siemens
APOGEE PXC Modular (BACnet)
Siemens
APOGEE PXC Modular (P2 Ethernet)
Siemens
TALON TC Compact (BACnet)
Siemens
TALON TC Modular (BACnet)
Subsystems
General OT
Sectors
Multiple
What to Know
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service. (NVD)
What to Do
Monitor Siemens's web page for any future patch releases.