# Siemens Building Automation Controllers DoS Flaws

Published: 2026-10-22 · Severity: routine · Sectors: Manufacturing, Transportation, Energy, Healthcare, Financial Services, Government (National)
Canonical: https://vorant.io/reports/6295854f-50f1-5d4a-8487-fe52af7a9f95/siemens-building-automation-controllers-dos-flaws

> CISA advisory details five vulnerabilities in Siemens APOGEE, TALON and Desigo PXC/PXM building controllers that could enable denial of service.

CISA published an ICS advisory covering multiple Siemens building automation product lines — APOGEE (MBC, MEC, PXC Compact, PXC Modular), TALON TC (Compact/Modular), and Desigo PXC/PXM controllers — affected by five vulnerabilities (CVE-2026-102073 through -102076 and CVE-2026-89208). The flaws stem from out-of-bounds read, integer underflow, and stack-based buffer overflow weaknesses (CWE-125, CWE-191, CWE-121) that could allow an attacker to cause a denial-of-service condition, impacting the availability of the affected controller. These are building/HVAC automation devices deployed worldwide across critical manufacturing, transportation, energy, healthcare, financial services, and government facilities sectors.

Siemens has released fixed versions for some products: TALON TC Compact/Modular and APOGEE PXC Compact/Modular (BACnet variants) should be updated to V3.5.7 or later, and P2 Ethernet variants to V2.8.21 or later. However, for several products — including APOGEE MBC/MEC (PPC) variants and the full Desigo PXC/PXM line (PXC00-U, PXC001-E.D, PXC100-E.D, PXC12-E.D, PXC128-U, PXC200-E.D, PXC22-E.D, PXC22.1-E.D, PXC36.1-E.D, PXC50-E.D, PXC64-U, PXM20-E, PXC00-E.D) — no fix is currently planned for CVE-2026-89208. For those, Siemens recommends network segmentation behind properly configured gateways/firewalls, and disabling the FTP/Web service (noted to be disabled by default).

No evidence of active exploitation is mentioned in the advisory. Defenders operating these building automation controllers should inventory affected models/versions, apply vendor patches where available, and implement network segmentation and service hardening for devices without a fix, given their presence in critical infrastructure environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076, CVE-2026-89208

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6295854f-50f1-5d4a-8487-fe52af7a9f95/siemens-building-automation-controllers-dos-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup