CVE-2026-102075: CWE-121: Stack-based Buffer Overflow in Siemens APOGEE MBC (PPC) (BACnet)

A stack-based buffer overflow vulnerability (CWE-121) exists in Siemens APOGEE and TALON product web services due to improper validation of user input in multipart handling. This vulnerability affects multiple product lines and versions, allowing an unauthenticated remote attacker to cause denial of service. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. No known exploits are reported in the wild. The affected versions include all versions of APOGEE MBC (PPC) (BACnet and P2 Ethernet), APOGEE MEC (PPC) (BACnet and P2 Ethernet), and TALON TC Modular (BACnet), and versions prior to 3.5.7 or 2.8.21 for APOGEE PXC Compact and Modular and TALON TC Compact (BACnet).

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exploiting a stack-based buffer overflow in the affected Siemens APOGEE and TALON product web services. There is no reported impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Siemens advisories for updates. Until a fix is available, consider restricting network access to the affected services to trusted sources to reduce exposure.