CVE-2026-102074

Executive Summary

CVE-2026-102074 is a stack-based buffer overflow (CWE-121) in the FTP service of Siemens APOGEE MBC/MEC and APOGEE/TALON PXC Compact/Modular building automation controllers. The FTP service fails to validate the length of user-controllable input, allowing an unauthenticated remote attacker to trigger a denial of service. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), this flaw poses a high-availability risk to building automation and control network (BACnet) environments.

Technical Analysis

The vulnerability resides in the FTP service exposed by the affected building controllers. According to the NVD description, the "affected product FTP service does not properly validate the length of user-controllable input." This maps to CWE-121 (Stack-based Buffer Overflow), indicating that an input value longer than the intended buffer size is copied into a stack-allocated buffer without bounds checking.

The attack surface is the network-facing FTP listener, which is reachable without authentication (PR:N) and requires no user interaction (UI:N). Because the overflow occurs in a stack buffer, an attacker-supplied string can overwrite adjacent stack memory, corrupting control data. In the observed vulnerability class, this typically results in process termination or a device fault rather than reliable code execution, which is consistent with the CVSS impact of A:H (high availability impact) and no confidentiality or integrity impact. No specific function names, class names, parameters, or file paths are provided in the source description; the analysis is therefore limited to the vulnerability class and its mechanism. The affected products include APOGEE MBC (PPC) (BACnet and P2 Ethernet), APOGEE MEC (PPC) (BACnet and P2 Ethernet), and fixed-version lines: APOGEE PXC Compact/Modular (BACnet < V3.5.7; P2 Ethernet < V2.8.21) and TALON TC Compact/Modular (BACnet < V3.5.7).

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain below is inferred strictly from the vulnerability class (stack-based buffer overflow in an FTP service) and the CVSS metrics.

1. Reconnaissance / target identification: An attacker scans for exposed FTP services (default port 21) on building automation controllers. Device fingerprints may match "Siemens", "APOGEE", "PXC", or "TALON" strings in banners or web interfaces. Shodan queries such as port:21 product:"Siemens" or port:21 "APOGEE" can identify candidate hosts.

2. Triggering the flaw: The attacker connects to the FTP service without credentials and sends a user-controllable input string that exceeds the expected length. The exact FTP command or parameter is not specified in the source data; the trigger is any input path where the service copies user data into a fixed-size stack buffer without length validation.

3. Payload/execution: Because the overflow is a stack-based buffer overflow (CWE-121), an oversized input can overwrite stack memory. In the absence of specific exploit details, the observable effect is memory corruption leading to a crash or service hang, consistent with the denial-of-service impact in the CVSS vector.

4. Post-exploitation impact: A successful overflow causes a denial of service of the FTP service and potentially the controller process. This affects availability (A:H) with no loss of confidentiality or integrity (C:N/I:N). Repeated or sustained attacks could disrupt building automation functions that depend on the controller.

Impact Assessment

The primary impact is availability. CVSS 3.1 subscores are: AV:N (network reachable), AC:L (low attack complexity), PR:N (no privileges required), UI:N (no user interaction), S:U (scope unchanged), C:N (no confidentiality impact), I:N (no integrity impact), A:H (high availability impact). Because the FTP service requires no authentication and the flaw is remotely triggerable, any internet- or network-exposed affected controller is at risk. Blast radius includes building automation networks using Siemens APOGEE MBC/MEC, APOGEE PXC Compact/Modular, and TALON TC Compact/Modular controllers. Disruption of these devices can affect HVAC, lighting, and other building systems, with potential operational and safety consequences. There is no evidence of CISA KEV listing or in-the-wild exploitation at this time.

Detection Guidance

Sigma Rule

title: CVE-2026-102074 - Siemens APOGEE/TALON FTP Stack Buffer Overflow DoS Attempt
id: 3f8e2a1c-9b4d-4e7a-8c1f-6d2a5b9e0c3f
status: experimental
description: Detects anomalous FTP traffic or process crashes indicative of a stack-based buffer overflow attempt against Siemens APOGEE/TALON controllers.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: network_connection
  product: zeek
detection:
  selection:
    destination_port: 21
    proto: tcp
  filter_known:
    source_ip:
      - '10.0.0.0/8'
  condition: selection and not filter_known
fields:
  - source_ip
  - destination_ip
  - destination_port
falsepositives:
  - Legitimate FTP administrative sessions
level: high
tags:
  - attack.t1190
  - cve.2026.102074

YARA Rule

rule CVE_2026_102074_FTP_Overflow_Attempt
{
    meta:
        description = "Detects oversized FTP input patterns targeting Siemens APOGEE/TALON controllers"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-102074"
        cve = "CVE-2026-102074"
    strings:
        $ftp_user = "USER " ascii nocase
        $ftp_pass = "PASS " ascii nocase
        $long_payload = /[A-Za-z0-9]{512,}/
    condition:
        (uint16(0) == 0x0d0a or true) and
        any of ($ftp_user, $ftp_pass) and $long_payload
}

Suricata IDS Rule

alert tcp any any -> any 21 (msg:"CVE-2026-102074 Siemens APOGEE/TALON FTP Stack Buffer Overflow Attempt"; flow:to_server,established; content:"USER"; nocase; depth:4; pcre:"/(USER|PASS)\s+[A-Za-z0-9]{512,}/i"; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-dos; reference:cve,2026-102074; sid:2026102074; rev:1;)

Elastic Detection

network where destination.port == 21 and network.transport == "tcp" and
  process.name : ("*ftp*", "*apogee*", "*pxc*", "*talon*") and
  event.action == "connection_attempted" and
  source.ip != null

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=zeek_conn dest_port=21
| where match(_raw, "(?i)(USER|PASS)\\s+[A-Za-z0-9]{512,}")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="ftp,cve-2026-102074,">
  <rule id="100207" level="12">
    <decoded_as>json</decoded_as>
    <field name="destination_port">21</field>
    <field name="proto">tcp</field>
    <match>USER|PASS</match>
    <regex>[A-Za-z0-9]{512,}</regex>
    <description>CVE-2026-102074: Possible FTP stack buffer overflow attempt against Siemens APOGEE/TALON controller</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102074,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the FTP service (TCP/21) on affected controllers using firewall rules or network segmentation. Allow only trusted administrative hosts.
   • Disable the FTP service if it is not operationally required.
   • Monitor for anomalous FTP traffic and unexpected controller reboots or service outages.

2. Patch/upgrade steps:

   • No vendor patch is available at this time. When Siemens publishes fixed firmware, upgrade:
     • APOGEE PXC Compact (BACnet) to >= V3.5.7
     • APOGEE PXC Compact (P2 Ethernet) to >= V2.8.21
     • APOGEE PXC Modular (BACnet) to >= V3.5.7
     • APOGEE PXC Modular (P2 Ethernet) to >= V2.8.21
     • TALON TC Compact (BACnet) to >= V3.5.7
     • TALON TC Modular (BACnet) to >= V3.5.7
   • APOGEE MBC/MEC (PPC) lines have no fixed version listed; monitor vendor advisories.

3. Long-term hardening:

   • Isolate building automation controllers on dedicated VLANs with strict ACLs.
   • Disable unused services and change default credentials where applicable.
   • Implement continuous monitoring for availability anomalies and maintain offline backups of controller configurations.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102074
• CWE-121: Stack-based Buffer Overflow — https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• Siemens ProductCERT advisories (monitor for CVE-2026-102074) — https://www.siemens.com/cert
• CISA ICS Advisories — https://www.cisa.gov/news-events/cybersecurity-advisories
• No public PoC, exploit code, or in-the-wild campaign evidence identified for CVE-2026-102074 at time of writing.