Siemens BACnet Field Panels (Update A)
Multiple vulnerabilities in the APOGEE PXC and TALON TC series of products could allow unauthenticated attackers to download sensitive information through the integrated webserver. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-9947US | medium5.3 | Exploit | ||
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote… | ||||
| CVE-2017-9946US | high7.5 | — | ||
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. An attacker with network access to the integrated web se… | ||||
references
External citations — patches, advisories, analysis.
- SSA-148078: Multiple Vulnerabilities in APOGEE/TALON Field Panels - CSAF Versionself
- SSA-148078: Multiple Vulnerabilities in APOGEE/TALON Field Panels - PDF Versionself
- SSA-148078: Multiple Vulnerabilities in APOGEE/TALON Field Panels - TXT Versionself
- ICS Advisory ICSA-17-285-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-17-285-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (24)
- MitigationAPOGEE PXC Compact (BACnet)
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Compact (BACnet)
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Compact (P2 Ethernet)
Disable the integrated webserver
- MitigationAPOGEE PXC Compact (P2 Ethernet)
Disable the integrated webserver
- MitigationAPOGEE PXC Modular (BACnet)
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Modular (BACnet)
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Modular (P2 Ethernet)
Disable the integrated webserver
- MitigationAPOGEE PXC Modular (P2 Ethernet)
Disable the integrated webserver
- MitigationTALON TC Compact (BACnet)
Please contact your local Siemens office for additional support
- MitigationTALON TC Compact (BACnet)
Please contact your local Siemens office for additional support
- MitigationTALON TC Modular (BACnet)
Please contact your local Siemens office for additional support
- MitigationTALON TC Modular (BACnet)
Please contact your local Siemens office for additional support
- No fix plannedAPOGEE PXC Compact (P2 Ethernet)
Currently no fix is planned
- No fix plannedAPOGEE PXC Compact (P2 Ethernet)
Currently no fix is planned
- No fix plannedAPOGEE PXC Modular (P2 Ethernet)
Currently no fix is planned
- No fix plannedAPOGEE PXC Modular (P2 Ethernet)
Currently no fix is planned
- FixedAPOGEE PXC Compact (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedAPOGEE PXC Compact (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedAPOGEE PXC Modular (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedAPOGEE PXC Modular (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Compact (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Compact (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Modular (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Modular (BACnet)
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan