SSA-944498

csafDEsiemens_psirt

SSA-944498: Buffer Overflow Vulnerability in Web Server of APOGEE and TALON Automation Devices

view advisory published 2021-09-14

A buffer overflow vulnerability in the integrated web server of multiple APOGEE and TALON automation devices could allow a remote attacker to execute arbitrary code on the devices with root privileges. Affected devices include the APOGEE MBC/MEC/PXC P2 Ethernet devices with Power Open Processors (PPC), APOGEE PXC BACnet devices, and TALON TC BACnet devices. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2021-27391UScritical9.8—
A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet)…
02

references

External citations — patches, advisories, analysis.

03

remediations (16)

  • MitigationAPOGEE MBC (PPC) (P2 Ethernet)

    Disable the integrated web server

  • MitigationAPOGEE MEC (PPC) (P2 Ethernet)

    Disable the integrated web server

  • MitigationAPOGEE PXC Compact (BACnet)

    Disable the integrated web server

  • MitigationAPOGEE PXC Compact (P2 Ethernet)

    Disable the integrated web server

  • MitigationAPOGEE PXC Modular (BACnet)

    Disable the integrated web server

  • MitigationAPOGEE PXC Modular (P2 Ethernet)

    Disable the integrated web server

  • MitigationTALON TC Compact (BACnet)

    Disable the integrated web server

  • MitigationTALON TC Modular (BACnet)

    Disable the integrated web server

  • No fix availableAPOGEE MBC (PPC) (P2 Ethernet)

    Currently no remediation is available

  • No fix availableAPOGEE MEC (PPC) (P2 Ethernet)

    Currently no remediation is available

  • No fix availableAPOGEE PXC Compact (P2 Ethernet)

    Currently no remediation is available

  • No fix availableAPOGEE PXC Modular (P2 Ethernet)

    Currently no remediation is available

  • FixedAPOGEE PXC Compact (BACnet)

    Update to V3.5.3 or later version

  • FixedAPOGEE PXC Modular (BACnet)

    Update to V3.5.3 or later version

  • FixedTALON TC Compact (BACnet)

    Update to V3.5.3 or later version

  • FixedTALON TC Modular (BACnet)

    Update to V3.5.3 or later version

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan