CyberSecBulletin
CVE-2026-102073NVD status: Awaiting Analysis

APOGEE MBC (PPC) (BACnet): Integer Underflow (Wrap or Wraparound)

Published Updated By the CyberSecBulletin desk

CVE-2026-102073 is a high-severity integer underflow (wrap or wraparound) vulnerability in APOGEE MBC (PPC) (BACnet) from Siemens, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected APOGEE MBC (PPC) (BACnet) versions: all versions. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.34% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update APOGEE PXC Compact (BACnet) to V3.5.7 or a later version.
  2. Update APOGEE PXC Compact (P2 Ethernet) to V2.8.21 or a later version.
  3. Update APOGEE PXC Modular (BACnet) to V3.5.7 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensAPOGEE MBC (PPC) (BACnet)all versionsNot stated
SiemensAPOGEE MBC (PPC) (P2 Ethernet)all versionsNot stated
SiemensAPOGEE MEC (PPC) (BACnet)all versionsNot stated
SiemensAPOGEE MEC (PPC) (P2 Ethernet)all versionsNot stated
SiemensAPOGEE PXC Compact (BACnet)before V3.5.7V3.5.7
SiemensAPOGEE PXC Compact (P2 Ethernet)before V2.8.21V2.8.21
SiemensAPOGEE PXC Modular (BACnet)before V3.5.7V3.5.7
SiemensAPOGEE PXC Modular (P2 Ethernet)before V2.8.21V2.8.21
SiemensTALON TC Compact (BACnet)before V3.5.7V3.5.7
SiemensTALON TC Modular (BACnet)before V3.5.7V3.5.7

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. Scored by CNA (siemens.com).

Scoring systemScoreSeverityScored by
CVSS 4.08.8HighCNA (siemens.com)
CVSS 3.18.2HighCNA (siemens.com)

Official description

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

More Integer Underflow (Wrap or Wraparound) vulnerabilities (CWE-191)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in APOGEE MBC (PPC) (BACnet)

All APOGEE MBC (PPC) (BACnet) vulnerabilities

Recent Integer Underflow (Wrap or Wraparound) vulnerabilities

Spotted an error? Tell us.