Siemens Apogee PXC, Talon TC database exposure flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Siemens building control devices expose encrypted databases via network access; attackers can download password files remotely.
Siemens Apogee PXC and Talon TC building automation devices contain an information disclosure vulnerability (CVE-2025-40757) that allows unrestricted network access to sensitive files, including encrypted database files containing passwords. The vulnerability affects all versions of Apogee PXC Series (both BACnet and P2 Ethernet variants) and Talon TC Series (BACnet). An unauthenticated attacker on the network can download the device's encrypted .db file without authentication, potentially obtaining credential material. CVSS v4 score is 6.3 with low attack complexity and no user interaction required. Siemens has not released patches; instead, the vendor recommends configuration hardening: changing default passwords, using strong credentials, and disabling telnet. CISA notes no known public exploitation has been reported to date. The vulnerability was reported by PwC researcher Johnathan Law.
Mentioned in this report
Detection guidance
Unauthenticated Download of Database File from Web Server (Building Automation Hunting)
Hunting rule for successful HTTP GET requests for .db files, the access pattern of CVE-2025-40757 on Siemens Apogee PXC and Talon TC devices when web or proxy logs are available. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Download of Database File from Web Server (Building Automation
Hunting)
description: Detects successful HTTP GET requests for .db files with no authenticated
username. This matches the CVE-2025-40757 behaviour on Siemens Apogee PXC and Talon
TC devices, where an unauthenticated network user can download the encrypted device
database. The report gives no exact URL path, so the rule keys on the file extension,
method and status only. It is intended for web or reverse-proxy logs in front of
BAS devices and for hunting.
tags:
- attack.collection
- attack.t1005
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-stem|endswith: .db
sc-status: 200
filter_authenticated:
cs-username|contains: '*'
condition: selection and not filter_authenticated
falsepositives:
- Web applications that legitimately serve SQLite or other .db files for download,
such as software update mirrors
- Authorised engineering backup of building automation controller configuration over
HTTP
level: low
id: 7f94757d-dba9-5992-81ea-777866fb6ed9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-05
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-05
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs