# Siemens Apogee PXC, Talon TC database exposure flaw

Published: 2025-09-11 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/176a3662-81be-599e-91cf-491e3ceaf9df/siemens-apogee-pxc-talon-tc-database-exposure-flaw

> Siemens building control devices expose encrypted databases via network access; attackers can download password files remotely.

Siemens Apogee PXC and Talon TC building automation devices contain an information disclosure vulnerability (CVE-2025-40757) that allows unrestricted network access to sensitive files, including encrypted database files containing passwords. The vulnerability affects all versions of Apogee PXC Series (both BACnet and P2 Ethernet variants) and Talon TC Series (BACnet). An unauthenticated attacker on the network can download the device's encrypted .db file without authentication, potentially obtaining credential material. CVSS v4 score is 6.3 with low attack complexity and no user interaction required. Siemens has not released patches; instead, the vendor recommends configuration hardening: changing default passwords, using strong credentials, and disabling telnet. CISA notes no known public exploitation has been reported to date. The vulnerability was reported by PwC researcher Johnathan Law.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40757

## Detection guidance (public sample)

### Unauthenticated Download of Database File from Web Server (Building Automation Hunting)

ATT&CK: T1005

Hunting rule for successful HTTP GET requests for .db files, the access pattern of CVE-2025-40757 on Siemens Apogee PXC and Talon TC devices when web or proxy logs are available. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated Download of Database File from Web Server (Building Automation
  Hunting)
description: Detects successful HTTP GET requests for .db files with no authenticated
  username. This matches the CVE-2025-40757 behaviour on Siemens Apogee PXC and Talon
  TC devices, where an unauthenticated network user can download the encrypted device
  database. The report gives no exact URL path, so the rule keys on the file extension,
  method and status only. It is intended for web or reverse-proxy logs in front of
  BAS devices and for hunting.
tags:
- attack.collection
- attack.t1005
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-stem|endswith: .db
    sc-status: 200
  filter_authenticated:
    cs-username|contains: '*'
  condition: selection and not filter_authenticated
falsepositives:
- Web applications that legitimately serve SQLite or other .db files for download,
  such as software update mirrors
- Authorised engineering backup of building automation controller configuration over
  HTTP
level: low
id: 7f94757d-dba9-5992-81ea-777866fb6ed9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-05
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/176a3662-81be-599e-91cf-491e3ceaf9df/siemens-apogee-pxc-talon-tc-database-exposure-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup