CVE-2021-27391 — Classic Buffer Overflow in Siemens Apogee PXC Bacnet Automation Controller Firmware

CWE-120 — Classic Buffer Overflow3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
2.9%
top 13.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Siemens Apogee PXC Bacnet Automation Controller FirmwareSiemens Apogee PXC Modular FirmwareSiemens Talon TC Compact Firmware+10 more
Timeline
PublishedSep 14
Latest updateMay 24

Description

A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions = V2.8), APOGEE PXC Modular (BACnet) (All versions = V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages13 packages

▶CVEListV5siemens/apogee_pxc_compactAll versions < V3.5.3, All versions >= V2.8+1
▶CVEListV5siemens/apogee_pxc_modularAll versions < V3.5.3, All versions >= V2.8+1

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-98pm-v23p-r2wf: A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2↗2022-05-24
▶
CVEList
CVE-2021-27391: A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2↗2021-09-14
▶
CVE-2021-27391 — Classic Buffer Overflow in Siemens | cvebase