Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < ...

CVE-2021-27391 · published 5 years ago
Summary

A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All vers...

What to do
  • Update siemens apogee_pxc_bacnet_automation_controller_firmware to version 3.5.3 or later.
  • Update siemens apogee_pxc_modular_\(bacnet\)_firmware to version 3.5.3 or later.
  • Update siemens talon_tc_compact_\(bacnet\)_firmware to version 3.5.3 or later.
  • Update siemens talon_tc_modular_\(bacnet\)_firmware to version 3.5.3 or later.
Affected software
VendorProductAffected versions
siemens apogee_mbc_\(ppc\)_\(p2_ethernet\)_firmware <= 2.6.3
cpe:2.3:o:siemens:apogee_mbc_\(ppc\)_\(p2_ethernet\)_firmware:*:*:*:*:*:*:*:*
siemens apogee_mec_\(ppc\)_\(p2_ethernet\)_firmware <= 2.6.3
cpe:2.3:o:siemens:apogee_mec_\(ppc\)_\(p2_ethernet\)_firmware:*:*:*:*:*:*:*:*
siemens apogee_pxc_bacnet_automation_controller_firmware < 3.5.3
cpe:2.3:o:siemens:apogee_pxc_bacnet_automation_controller_firmware:*:*:*:*:*:*:*:*
siemens apogee_pxc_compact_\(p2_ethernet\)_firmware <= 2.8
cpe:2.3:o:siemens:apogee_pxc_compact_\(p2_ethernet\)_firmware:*:*:*:*:*:*:*:*
siemens apogee_pxc_modular_\(bacnet\)_firmware < 3.5.3
cpe:2.3:o:siemens:apogee_pxc_modular_\(bacnet\)_firmware:*:*:*:*:*:*:*:*
siemens apogee_pxc_modular_\(p2_ethernet\)_firmware <= 2.8
cpe:2.3:o:siemens:apogee_pxc_modular_\(p2_ethernet\)_firmware:*:*:*:*:*:*:*:*
siemens talon_tc_compact_\(bacnet\)_firmware < 3.5.3
cpe:2.3:o:siemens:talon_tc_compact_\(bacnet\)_firmware:*:*:*:*:*:*:*:*
siemens talon_tc_modular_\(bacnet\)_firmware < 3.5.3
cpe:2.3:o:siemens:talon_tc_modular_\(bacnet\)_firmware:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < ...
A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-120Classic Buffer Overflow
Timeline
Published14 Sep 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-27391 · NVD
Track software like this
Free during beta