advisory Imported story

Siemens APOGEE, TALON and Desigo PXC/PXM Products

Source: CISA Cybersecurity Advisories · Published Oct 22, 2026 12:00 UTC · Last checked 1 day ago · 1 min read

Illustration generated by CyberSecurity.pk from the story topic.

Publisher excerpt From CISA Cybersecurity Advisories

View CSAF Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected: APOGEE MBC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MBC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Modular (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Modular (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) Desigo PXC00-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC00-U vers:intdot/…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.

View CSAF

Summary

The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.

The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected:

APOGEE MBC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
APOGEE MBC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
APOGEE MEC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
APOGEE PXC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
APOGEE PXC Compact (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
APOGEE PXC Modular (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
APOGEE PXC Modular (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
Desigo PXC00-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC00-U vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC001-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC100-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC12-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC128-U vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC200-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC22-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC22.1-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC36.1-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC50-E.D vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXC64-U vers:intdot/>=2.3 (CVE-2026-89208)
Desigo PXM20-E vers:intdot/>=2.3 (CVE-2026-89208)
TALON TC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
TALON TC Modular (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)

CVSS	Vendor	Equipment
v3 8.2	Siemens	APOGEE MBC (PPC) (BACnet)

3 Vulnerabilities
Out-of-bounds Read, Integer Underflow (Wrap or Wraparound), Stack-based Buffer Overflow

Background

Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-89208

The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Desigo PXC00-U >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC001-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC100-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC12-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC128-U >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC200-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC22-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC22.1-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC36.1-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC50-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC64-U >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXM20-E >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Desigo PXC00-E.D >= V2.3

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

No fix planned
Currently no fix is planned

Additional Metrics

Relevant CWE: CWE-125 Out-of-bounds Read

CVSS Version	Base Score	Base Severity	Vector String
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View CVE Details

CVE-2026-102073

The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.

Desigo PXC00-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC001-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC100-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC12-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC128-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC200-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC36.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC50-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC64-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXM20-E >= V2.3

Product Status: known_affected

Remediations

Desigo PXC00-E.D >= V2.3

Product Status: known_affected

Remediations

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE PXC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

Additional Metrics

Relevant CWE: CWE-191 Integer Underflow (Wrap or Wraparound)

CVSS Version	Base Score	Base Severity	Vector String
3.1	8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

View CVE Details

CVE-2026-102074

The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.

Desigo PXC00-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC001-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC100-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC12-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC128-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC200-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC36.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC50-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC64-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXM20-E >= V2.3

Product Status: known_affected

Remediations

Desigo PXC00-E.D >= V2.3

Product Status: known_affected

Remediations

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE PXC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE PXC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

Additional Metrics

Relevant CWE: CWE-121 Stack-based Buffer Overflow

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View CVE Details

CVE-2026-102075

The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.

Desigo PXC00-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC001-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC100-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC12-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC128-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC200-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC36.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC50-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC64-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXM20-E >= V2.3

Product Status: known_affected

Remediations

Desigo PXC00-E.D >= V2.3

Product Status: known_affected

Remediations

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE PXC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE PXC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE PXC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

Additional Metrics

Relevant CWE: CWE-121 Stack-based Buffer Overflow

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View CVE Details

CVE-2026-102076

The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.

Desigo PXC00-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC001-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC100-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC12-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC128-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXC200-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC22.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC36.1-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC50-E.D >= V2.3

Product Status: known_affected

Remediations

Desigo PXC64-U >= V2.3

Product Status: known_affected

Remediations

Desigo PXM20-E >= V2.3

Product Status: known_affected

Remediations

Desigo PXC00-E.D >= V2.3

Product Status: known_affected

Remediations

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE PXC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V2.8.21 or later version

APOGEE MBC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MBC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

TALON TC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

TALON TC Modular (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE MEC (PPC) (BACnet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE MEC (PPC) (P2 Ethernet)

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

No fix planned
Currently no fix is planned

APOGEE PXC Compact (BACnet) < V3.5.7

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Vendor fix
Update to V3.5.7 or later version

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Product Status: known_affected

Remediations

Mitigation
CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.

Mitigation
Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)

Related CVEs

CVE-2026-102073 · HIGH CVE-2026-102074 · HIGH CVE-2026-102075 · HIGH CVE-2026-102076 · HIGH CVE-2026-89208 · MEDIUM

Keywords: rce CVE-2026-102073 CVE-2026-102074 CVE-2026-102075 CVE-2026-102076 CVE-2026-89208 advisory advisory news CISA Cybersecurity Advisories cybersecurity news security news Pakistan

Reference: CISA Cybersecurity Advisories — www.cisa.gov ↗

Siemens APOGEE, TALON and Desigo PXC/PXM Products

Publisher excerpt From CISA Cybersecurity Advisories

Summary

Background

Vulnerabilities

13 Affected Products

Desigo PXC00-U >= V2.3

Remediations

Desigo PXC001-E.D >= V2.3

Remediations

Desigo PXC100-E.D >= V2.3

Remediations

Desigo PXC12-E.D >= V2.3

Remediations

Desigo PXC128-U >= V2.3

Remediations

Desigo PXC200-E.D >= V2.3

Remediations

Desigo PXC22-E.D >= V2.3

Remediations

Desigo PXC22.1-E.D >= V2.3

Remediations

Desigo PXC36.1-E.D >= V2.3

Remediations

Desigo PXC50-E.D >= V2.3

Remediations

Desigo PXC64-U >= V2.3

Remediations

Desigo PXM20-E >= V2.3

Remediations

Desigo PXC00-E.D >= V2.3

Remediations

Additional Metrics

23 Affected Products

Desigo PXC00-U >= V2.3

Remediations

Desigo PXC001-E.D >= V2.3

Remediations

Desigo PXC100-E.D >= V2.3

Remediations

Desigo PXC12-E.D >= V2.3

Remediations

Desigo PXC128-U >= V2.3

Remediations

Desigo PXC200-E.D >= V2.3

Remediations

Desigo PXC22-E.D >= V2.3

Remediations

Desigo PXC22.1-E.D >= V2.3

Remediations

Desigo PXC36.1-E.D >= V2.3

Remediations

Desigo PXC50-E.D >= V2.3

Remediations

Desigo PXC64-U >= V2.3

Remediations

Desigo PXM20-E >= V2.3

Remediations

Desigo PXC00-E.D >= V2.3

Remediations

APOGEE MBC (PPC) (BACnet)

Remediations

APOGEE MBC (PPC) (P2 Ethernet)

Remediations

TALON TC Compact (BACnet) < V3.5.7

Remediations

TALON TC Modular (BACnet) < V3.5.7

Remediations

APOGEE MEC (PPC) (BACnet)

Remediations

APOGEE MEC (PPC) (P2 Ethernet)

Remediations

APOGEE PXC Compact (BACnet) < V3.5.7

Remediations

APOGEE PXC Compact (P2 Ethernet) < V2.8.21

Remediations

APOGEE PXC Modular (BACnet) < V3.5.7

Remediations

APOGEE PXC Modular (P2 Ethernet) < V2.8.21

Remediations