Multiple DoS Vulnerabilities (CVE‑2026‑102073 – CVE‑2026‑102076) in Siemens APOGEE, TALON and Desigo PXC/PXM Products
What It Is – CISA has identified four new CVEs affecting a broad set of Siemens building‑automation controllers. The flaws can be triggered to cause denial‑of‑service conditions, potentially rendering HVAC, lighting, or safety systems unavailable.
Exploitability – No public exploit code has been released, but the vulnerabilities are exploitable by a remote attacker who can reach the device’s management interface; CVSS scores are in the high range (≈7.5).
Affected Products – All versions of APOGEE MBC (BACnet & P2 Ethernet), APOGEE MEC (BACnet & P2 Ethernet), APOGEE PXC Compact/Modular (BACnet & P2 Ethernet) and Desigo PXC/PXM devices listed in the advisory. Siemens has published updated firmware for many models and mitigation guidance for those still pending a fix.
Why It Matters for Trust & Control Assurance
- Continuous vendor‑risk monitoring – Demonstrating that you track and apply vendor‑issued patches is a core evidence point for audit readiness across frameworks.
- Availability controls – DoS‑type flaws test the “ensure system availability” control objective; proof of timely remediation shows a resilient control environment.
- Defensible audit trail – Maintaining records of firmware updates and mitigation steps provides the documentation auditors expect for continuity and resilience controls.
Recommended Actions
- Inventory all Siemens APOGEE, TALON and Desigo devices and map them to the affected version list.
- Apply the Siemens‑provided firmware updates immediately for any product with a fix.
- For devices without a patch, implement the vendor‑recommended mitigations (network segmentation, traffic filtering, disabling unnecessary services).
- Record the remediation steps in a centralized control‑evidence repository to support continuous monitoring and audit readiness.
Source: CISA Advisory – ICSA‑26‑295‑08