CVE-2026-102075

Executive Summary

CVE-2026-102075 is an unauthenticated remote denial-of-service vulnerability affecting the embedded web service of Siemens APOGEE and TALON building automation controllers. The web service fails to properly validate user input during multipart form/data handling, allowing a crafted request to destabilize or crash the service. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), any network-reachable instance is exposed to trivial, repeatable availability attacks with no authentication or user interaction required.

Technical Analysis

The vulnerability resides in the multipart handling logic of the affected product web service. Multipart handling is the parsing path used by HTTP servers to process multipart/form-data requests — most commonly uploaded files and form field bodies delimited by a boundary string and per-part Content-Disposition headers. In this implementation, user-supplied input within the multipart request is not properly validated before being processed.

The assigned weakness, CWE-121 (Stack-based Buffer Overflow), describes the class of failure: input that exceeds the size or structural expectations of a fixed-length stack buffer during parsing can overwrite adjacent stack memory. Because the flaw is classified CWE-121 rather than a generic input-validation issue, the most plausible mechanism is a boundary, header, or part-body field whose length or structure is not bounds-checked before being copied into a stack-allocated buffer inside the web service's multipart parser.

The CVSS impact vector is C:N/I:N/A:H: confidentiality and integrity impacts are assessed as none, and the sole impact is high availability. This is consistent with a memory-corruption condition in a network-facing service process that is not exercised in a way yielding code execution or data disclosure — the observable outcome is a crash or hang of the web service, producing loss of availability for the management interface. There is no evidence in the available data of authentication bypass, information disclosure, or remote code execution.

Affected components span multiple product lines and two distinct protocol/interface variants:

• APOGEE MBC (PPC), both BACnet and P2 Ethernet interface variants — all versions affected.
• APOGEE MEC (PPC), both BACnet and P2 Ethernet interface variants — all versions affected.
• APOGEE PXC Compact (BACnet) — all versions below V3.5.7.
• APOGEE PXC Compact (P2 Ethernet) — all versions below V2.8.21.
• APOGEE PXC Modular (BACnet) — all versions below V3.5.7.
• APOGEE PXC Modular (P2 Ethernet) — all versions below V2.8.21.
• TALON TC Compact (BACnet) — all versions below V3.5.7.
• TALON TC Modular (BACnet) — all versions below V3.5.7.

The differing fix thresholds between the BACnet and P2 Ethernet builds (V3.5.7 versus V2.8.21) indicate the two firmware families maintain separate version streams even where the affected hardware platform is shared. The MBC (PPC) and MEC (PPC) entries are listed as "All versions" with no fixed version identified, meaning no remediation threshold has been published for those models in the available advisory data.

Attack surface: the web service listens on the controller's network interface and is reachable by any host that can route to the device — building automation networks are frequently flat, and remote access is often provisioned for integrator and facility-management use. The vulnerability is pre-authentication: PR:N confirms no credentials are required, so the multipart parser is reachable before any session or access control is established.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (CWE-121, unvalidated multipart input) and the CVSS vector; no specific endpoints, parameters, or function names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. An attacker scans for reachable building automation controllers using the HTTP fingerprint of the affected web service (e.g., Shodan queries for http.title:"APOGEE" or http.html:"BACnet") and maps exposed management interfaces. Because no authentication is required, the attacker only needs to confirm that the web service is reachable and accepts multipart requests.

2. Triggering the flaw class. The attacker sends an HTTP request with a multipart/form-data body to the affected web service. The malformation — an oversized or structurally invalid boundary, part header, or part body — is passed into the multipart parser without adequate bounds validation, leading to a stack-based buffer overflow (CWE-121).

3. Payload/execution method at the class level. The payload is delivered entirely within the body of a single unauthenticated HTTP request on the web service port. No credentials, tokens, or prior session state are required (PR:N, UI:N). The request is low-complexity and repeatable (AC:L).

4. Post-exploitation impact. The consequence is a crash or hang of the web service process, resulting in denial of service (A:H). The attacker gains no confidentiality or integrity impact (C:N/I:N). An attacker can sustain the denial of service by resending the request, denying operators access to the controller's web management interface for as long as the attack continues.

Impact Assessment

The business impact is availability-focused. CVSS subscores: A:H (High availability impact) dominates, with C:N and I:N (no confidentiality or integrity impact) and S:U (scope unchanged — the impact is confined to the vulnerable web service component). The exploitability metrics are maximally favorable to an attacker: AV:N (network reachable), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction).

Blast radius: APOGEE PXC Compact/Modular, APOGEE MBC (PPC), APOGEE MEC (PPC), and TALON TC Compact/Modular controllers are building automation and facility management devices — they govern HVAC, and in many deployments broader environmental control. Loss of the web service interface degrades operator visibility and remote management capability for the affected controller. The vulnerability itself does not, per the impact vector, extend to control logic integrity or data exfiltration; however, in operational technology environments, loss of management access and process monitoring can translate to real-world consequences for building occupants and operations if sustained. The MBC/MEC lines carry "all versions affected" status with no fixed version, so those devices are exposed indefinitely until a firmware remediation becomes available. CVSS 7.5 places this in the High severity band; it is not listed in CISA KEV and no exploit-in-the-wild evidence exists in the provided data.

Detection Guidance

Sigma Rule

title: APOGEE/TALON Web Service Multipart DoS Attempt (CVE-2026-102075)
id: 9b3c1f42-7e10-4a8d-bd21-2c6f0a7e5d13
status: experimental
description: Detects malformed or oversized multipart/form-data requests to APOGEE/TALON controller web services that may trigger CVE-2026-102075.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102075
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_content:
    cs-content-type|contains: 'multipart/form-data'
  selection_malformed:
    - cs-uri-query|contains: 'boundary'
    - sc-bytes|gte: 100000
  condition: selection_method and selection_content and selection_malformed
fields:
  - c-ip
  - cs-uri
  - cs-content-type
  - sc-bytes
falsepositives:
  - Legitimate large firmware uploads to the controller
  - Authorized integrator multipart operations
level: high

YARA Rule

rule CVE_2026_102075_APOGEE_Multipart_DoS
{
    meta:
        description = "Detects suspicious multipart payloads targeting APOGEE/TALON web services (CVE-2026-102075)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102075"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"
    strings:
        $mp = "multipart/form-data" nocase
        $boundary = "boundary=" nocase
        $disp = "Content-Disposition:" nocase
        $apogee = "APOGEE" nocase
        $bacnet = "BACnet" nocase
    condition:
        uint16(0) == 0x4850 and
        $mp and $boundary and
        ($disp or $apogee or $bacnet) and
        filesize > 50KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102075 APOGEE/TALON Multipart DoS Attempt"; flow:to_server,established; http.method; content:"POST"; http.header; content:"multipart/form-data"; nocase; http.header; content:"boundary="; nocase; dsize:>60000; threshold:type threshold, track by_src, count 5, seconds 30; classtype:attempted-dos; reference:cve,2026-102075; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102075; sid:2026102075; rev:1;)

Elastic Detection

network where (http.request.method == "POST" and http.request.headers.content_type like "multipart/form-data*") and (http.request.body.bytes > 60000 or http.request.bytes > 60000)

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| where method="POST" AND like(content_type, "%multipart/form-data%")
| eval large_body=if(bytes > 60000, 1, 0)
| stats count AS requests, sum(large_body) AS large_requests by src_ip, dest_ip, uri
| where large_requests >= 3
| sort - large_requests

Wazuh OSSEC Rule

<group name="web,apogee,cve-2026-102075,">
  <rule id="2026107" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>multipart/form-data</match>
    <description>CVE-2026-102075: Suspicious multipart request to APOGEE/TALON web service</description>
  </rule>
  <rule id="2026108" level="12" frequency="3" timeframe="60">
    <if_matched_sid>2026107</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-102075: Repeated malformed multipart requests from same source - possible DoS attempt</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists in any tracked source. The advisory version ranges specify fixed thresholds (V3.5.7 for BACnet builds, V2.8.21 for P2 Ethernet builds on PXC and TALON TC), but no vendor fix artifact or advisory URL has been confirmed. MBC (PPC) and MEC (PPC) are listed as "all versions affected" with no remediation version published.

1) Immediate mitigations:

• Restrict network access to the controller web service. Place APOGEE and TALON controllers behind segmented VLANs and deny inbound HTTP/HTTPS from untrusted networks and the internet.
• Enforce strict firewall ACLs so that only authorized management stations can reach the controller web interface; close any internet-facing exposure immediately.
• Where firmware permits, disable the embedded web service if remote web management is not operationally required.
• Monitor for repeated unauthenticated POST requests with multipart/form-data bodies as an early indicator of attempted exploitation (see Detection Guidance).

2) Patch/upgrade steps:

• For APOGEE PXC Compact/Modular and TALON TC (BACnet builds), upgrade to V3.5.7 or later once firmware is available from the vendor.
• For APOGEE PXC Compact/Modular (P2 Ethernet builds), upgrade to V2.8.21 or later.
• For APOGEE MBC (PPC) and MEC (PPC), no fixed version is identified in the available data — track the vendor advisory for a remediation firmware and apply it when released.
• Validate firmware images against vendor-published checksums/signatures before deployment.

3) Long-term hardening:

• Adopt an OT network architecture with strict segmentation between building automation networks and corporate/IT networks; prohibit direct internet egress/ingress for controller management interfaces.
• Inventory all APOGEE and TALON controllers against the affected version list and track them in the asset management system with firmware versions and exposure status.
• Establish a firmware patch cadence for building automation controllers rather than deferring updates to commissioning cycles.
• Once a patch cycle completes, deploy network monitoring to detect malformed multipart traffic as a regression control.

References

• National Vulnerability Database — CVE-2026-102075: https://nvd.nist.gov/vuln/detail/CVE-2026-102075
• MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102075 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Siemens ProductCERT / vendor security advisories portal for APOGEE and TALON firmware updates: https://www.siemens.com/global/en/products/services/cert.html

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-102075. No threat actor campaign or exploit-in-the-wild evidence is currently associated with this CVE, and it is not listed in CISA KEV.