Siemens Building Automation Controllers DoS Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CISA advisory details five vulnerabilities in Siemens APOGEE, TALON and Desigo PXC/PXM building controllers that could enable denial of service.
CISA published an ICS advisory covering multiple Siemens building automation product lines — APOGEE (MBC, MEC, PXC Compact, PXC Modular), TALON TC (Compact/Modular), and Desigo PXC/PXM controllers — affected by five vulnerabilities (CVE-2026-102073 through -102076 and CVE-2026-89208). The flaws stem from out-of-bounds read, integer underflow, and stack-based buffer overflow weaknesses (CWE-125, CWE-191, CWE-121) that could allow an attacker to cause a denial-of-service condition, impacting the availability of the affected controller. These are building/HVAC automation devices deployed worldwide across critical manufacturing, transportation, energy, healthcare, financial services, and government facilities sectors.
Siemens has released fixed versions for some products: TALON TC Compact/Modular and APOGEE PXC Compact/Modular (BACnet variants) should be updated to V3.5.7 or later, and P2 Ethernet variants to V2.8.21 or later. However, for several products — including APOGEE MBC/MEC (PPC) variants and the full Desigo PXC/PXM line (PXC00-U, PXC001-E.D, PXC100-E.D, PXC12-E.D, PXC128-U, PXC200-E.D, PXC22-E.D, PXC22.1-E.D, PXC36.1-E.D, PXC50-E.D, PXC64-U, PXM20-E, PXC00-E.D) — no fix is currently planned for CVE-2026-89208. For those, Siemens recommends network segmentation behind properly configured gateways/firewalls, and disabling the FTP/Web service (noted to be disabled by default).
No evidence of active exploitation is mentioned in the advisory. Defenders operating these building automation controllers should inventory affected models/versions, apply vendor patches where available, and implement network segmentation and service hardening for devices without a fix, given their presence in critical infrastructure environments.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs