attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is none; availability impact is low.
Affected products
see table below
Classified as
CWE-191 (Integer Underflow (Wrap or Wraparound))
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Siemens
APOGEE MBC (PPC) (BACnet)
Siemens
APOGEE MBC (PPC) (P2 Ethernet)
Siemens
APOGEE MEC (PPC) (BACnet)
Siemens
APOGEE MEC (PPC) (P2 Ethernet)
Siemens
APOGEE PXC Compact (BACnet)
Siemens
APOGEE PXC Compact (P2 Ethernet)
Siemens
APOGEE PXC Modular (BACnet)
Siemens
APOGEE PXC Modular (P2 Ethernet)
Siemens
TALON TC Compact (BACnet)
Siemens
TALON TC Modular (BACnet)
Subsystems
General OT
Sectors
Multiple
What to Know
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition. (NVD)
What to Do
Monitor Siemens's web page for any future patch releases.