Siemens APOGEE and TALON
A buffer overflow vulnerability in the integrated web server of multiple APOGEE and TALON automation devices could allow a remote attacker to execute arbitrary code on the devices with root privileges. Affected devices include the APOGEE MBC/MEC/PXC P2 Ethernet devices with Power Open Processors (PPC), APOGEE PXC BACnet devices, and TALON TC BACnet devices. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-27391US | critical9.8 | — | ||
A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet)… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-944498: Buffer Overflow Vulnerability in Web Server of APOGEE and TALON Automation Devices - CSAF Versionself
- SSA-944498: Buffer Overflow Vulnerability in Web Server of APOGEE and TALON Automation Devices - PDF Versionself
- SSA-944498: Buffer Overflow Vulnerability in Web Server of APOGEE and TALON Automation Devices - TXT Versionself
- ICS Advisory ICSA-21-257-07 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-257-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (16)
- MitigationAPOGEE MBC (PPC) (P2 Ethernet)
Disable the integrated web server
- MitigationAPOGEE MEC (PPC) (P2 Ethernet)
Disable the integrated web server
- MitigationAPOGEE PXC Compact (BACnet)
Disable the integrated web server
- MitigationAPOGEE PXC Compact (P2 Ethernet)
Disable the integrated web server
- MitigationAPOGEE PXC Modular (BACnet)
Disable the integrated web server
- MitigationAPOGEE PXC Modular (P2 Ethernet)
Disable the integrated web server
- MitigationTALON TC Compact (BACnet)
Disable the integrated web server
- MitigationTALON TC Modular (BACnet)
Disable the integrated web server
- Kein Fix verfügbarAPOGEE MBC (PPC) (P2 Ethernet)
Currently no remediation is available
- Kein Fix verfügbarAPOGEE MEC (PPC) (P2 Ethernet)
Currently no remediation is available
- Kein Fix verfügbarAPOGEE PXC Compact (P2 Ethernet)
Currently no remediation is available
- Kein Fix verfügbarAPOGEE PXC Modular (P2 Ethernet)
Currently no remediation is available
- BehobenAPOGEE PXC Compact (BACnet)
Update to V3.5.3 or later version
- BehobenAPOGEE PXC Modular (BACnet)
Update to V3.5.3 or later version
- BehobenTALON TC Compact (BACnet)
Update to V3.5.3 or later version
- BehobenTALON TC Modular (BACnet)
Update to V3.5.3 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan