CVE-2017-9946
mediumpriority · track · 39EPSS 0.250 · 98 %ileDEEUUSEPSS · scored 2026-10-27
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. An attacker with network access to the integrated web server (80/tcp and 443/tcp) could bypass the authentication and download sensitive information from the device.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedAPOGEE PXC Compact (BACnet)siemens_psirt
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedAPOGEE PXC Modular (BACnet)siemens_psirt
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Compact (BACnet)siemens_psirt
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Modular (BACnet)siemens_psirt
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedAPOGEE PXC Compact (BACnet)cisa_csaf_ot
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedAPOGEE PXC Modular (BACnet)cisa_csaf_ot
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Compact (BACnet)cisa_csaf_ot
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - FixedTALON TC Modular (BACnet)cisa_csaf_ot
Update to V3.5 or later version
https://partnerportal.extranet.dc.siemens.com/ - MitigationAPOGEE PXC Compact (BACnet)siemens_psirt
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Compact (P2 Ethernet)siemens_psirt
Disable the integrated webserver
- MitigationAPOGEE PXC Modular (BACnet)siemens_psirt
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Modular (P2 Ethernet)siemens_psirt
Disable the integrated webserver
- MitigationTALON TC Compact (BACnet)siemens_psirt
Please contact your local Siemens office for additional support
- MitigationTALON TC Modular (BACnet)siemens_psirt
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Compact (BACnet)cisa_csaf_ot
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Compact (P2 Ethernet)cisa_csaf_ot
Disable the integrated webserver
- MitigationAPOGEE PXC Modular (BACnet)cisa_csaf_ot
Please contact your local Siemens office for additional support
- MitigationAPOGEE PXC Modular (P2 Ethernet)cisa_csaf_ot
Disable the integrated webserver
- MitigationTALON TC Compact (BACnet)cisa_csaf_ot
Please contact your local Siemens office for additional support
- MitigationTALON TC Modular (BACnet)cisa_csaf_ot
Please contact your local Siemens office for additional support
- No fix plannedAPOGEE PXC Compact (P2 Ethernet)siemens_psirt
Currently no fix is planned
- No fix plannedAPOGEE PXC Modular (P2 Ethernet)siemens_psirt
Currently no fix is planned
- No fix plannedAPOGEE PXC Compact (P2 Ethernet)cisa_csaf_ot
Currently no fix is planned
- No fix plannedAPOGEE PXC Modular (P2 Ethernet)cisa_csaf_ot
Currently no fix is planned
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (23)
Products and version ranges known to be affected.
- n/a APOGEE PXC and TALON TC BACnet Automation Controllers All versions <V3.5APOGEE PXC and TALON TC BACnet Automation Controllers All versions → V3.5enisa_euvdEU
- siemens apogee pxc modular firmware< 3.5nvdUScpe:2.3:o:siemens:apogee_pxc_modular_firmware:*:*:*:*:*:*:*:*
- siemens talon tc compact firmware< 3.5nvdUScpe:2.3:o:siemens:talon_tc_compact_firmware:*:*:*:*:*:*:*:*
- siemens talon tc modular firmware< 3.5nvdUScpe:2.3:o:siemens:talon_tc_modular_firmware:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-148078SSA-148078: Multiple Vulnerabilities in APOGEE/TALON Field Panels2017-10-12csaf · siemens_psirtDE
Multiple vulnerabilities in the APOGEE PXC and TALON TC series of products could allow unauthenticated attackers to download sensitive information through the integrated webserver. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
- ICSA-17-285-05Siemens BACnet Field Panels (Update A)2017-10-12icsa · cisa_csaf_otUS
Multiple vulnerabilities in the APOGEE PXC and TALON TC series of products could allow unauthenticated attackers to download sensitive information through the integrated webserver. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-148078.pdfcnnvd
- https://cxsecurity.com/issue/WLB-2022100069cnnvd
- https://packetstormsecurity.com/files/169544/Siemens-APOGEE-PXC-TALON-TC-Authentication-Bypass.htmlcnnvd
- https://us-cert.cisa.gov/ics/advisories/ICSA-17-285-05cnnvd
- https://www.securityfocus.com/bid/101248cnnvd
- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-148078.pdfcnnvd
- http://packetstormsecurity.com/files/169544/Siemens-APOGEE-PXC-TALON-TC-Authentication-Bypass.htmlenisa_euvd
- http://www.securityfocus.com/bid/101248enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan