CVE-2026-102074: CWE-121: Stack-based Buffer Overflow in Siemens APOGEE MBC (PPC) (BACnet)

This vulnerability is a stack-based buffer overflow (CWE-121) in the FTP service of Siemens APOGEE and TALON building automation controllers. The FTP service does not properly validate the length of user-controlled input, enabling an unauthenticated remote attacker to trigger a denial of service by causing a crash or instability. The vulnerability affects multiple product lines and versions, specifically all versions of APOGEE MBC (PPC) (BACnet and P2 Ethernet), APOGEE MEC (PPC) (BACnet and P2 Ethernet), and TALON TC Modular (BACnet), and versions prior to 3.5.7 or 2.8.21 for APOGEE PXC Compact and Modular and TALON TC Compact (BACnet). The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service). No known exploits are reported in the wild. Siemens has not provided explicit patch links or advisories in the input data, and the patch status is not confirmed.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service on affected Siemens APOGEE and TALON devices by sending specially crafted input to the FTP service. This results in service disruption, potentially impacting building automation system availability. There is no reported impact on confidentiality or integrity.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until a patch is applied, consider restricting network access to the FTP service on affected devices to trusted sources only to reduce exposure. Monitor for unusual FTP traffic patterns that could indicate exploitation attempts.