CVE-2026-102073: CWE-191: Integer Underflow (Wrap or Wraparound) in Siemens APOGEE MBC (PPC) (BACnet)

This vulnerability (CVE-2026-102073) involves an integer underflow (CWE-191) in Siemens APOGEE MBC (PPC) (BACnet and P2 Ethernet), APOGEE MEC (PPC) (BACnet and P2 Ethernet), APOGEE PXC Compact and Modular (BACnet and P2 Ethernet), and TALON TC Compact and Modular (BACnet). The root cause is improper validation of the length of user-controllable input in the product web service, which can lead to reading device memory contents or denial-of-service. The vulnerability affects all versions of APOGEE MBC and MEC products, and versions prior to 3.5.7 or 2.8.21 for APOGEE PXC and TALON products as specified. The CVSS v3.1 score is 8.2, indicating high severity, with network attack vector, no privileges or user interaction required, and high confidentiality impact but no integrity impact.

An unauthenticated remote attacker can exploit this vulnerability to read portions of device memory, potentially exposing sensitive information, or cause a denial-of-service condition, disrupting device availability. The confidentiality impact is high, while integrity is not impacted. Availability impact is low.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor Siemens advisories for updates. Until a fix is available, restrict network access to affected devices and consider additional network-level protections to limit exposure.