Siemens building controllers carry four flaws that let strangers crash them from the internet

Key points

• Siemens disclosed four flaws on 13 October 2026 in APOGEE, TALON and Desigo PXC/PXM building controllers, hardware that runs heating, ventilation and access systems inside hospitals, airports and government buildings.
• The three highest-rated bugs, CVE-2026-102073, CVE-2026-102074 and CVE-2026-102075, score 8.7 or 8.8 and can be triggered by anyone on the network, no password needed.
• CVE-2026-102073 can also leak chunks of device memory, not just crash the unit.
• Fixes exist for APOGEE PXC Compact and Modular (BACnet V3.5.7, P2 Ethernet V2.8.21) and TALON TC (V3.5.7). MBC and MEC lines get no fix.
• The thirteen Desigo PXC and PXM models hit by a separate memory-read flaw, CVE-2026-89208, have no planned patch; Siemens tells owners to wall them off behind a firewall.

Siemens has published a fresh advisory for a family of building controllers, the small industrial computers that sit in plant rooms and tell a building when to heat, cool or vent. The advisory, carried through CISA on 13 October 2026, covers the APOGEE, TALON and Desigo PXC/PXM ranges. These units run worldwide across critical manufacturing, transport, energy, healthcare, financial and government sites.

Four new CVE identifiers are involved. Three are rated high severity and can be reached by an unauthenticated attacker over the network; no login required.

What can an attacker actually do?

Crash the controller from a distance, and in one case read small pieces of its memory. None of the four flaws, on their own, enables full remote control.

The worst of the set is CVE-2026-102073, scored 8.8. The web service on the controller doesn't check how long an incoming piece of user input is, so a crafted request can either knock the device offline or spill portions of its memory to the sender. CVE-2026-102074, scored 8.7, applies the same logic to the FTP service (the file-transfer feature), causing a denial of service where the controller stops responding. CVE-2026-102075, also 8.7, abuses how multipart uploads are handled by the web service and produces the same result.

The fourth bug, CVE-2026-89208, affects thirteen Desigo PXC and PXM models from V2.3 onward. It lets an attacker read memory outside the intended packet boundaries, a weakness tracked as CWE-125. Its CVSS score is 5.3.

Which devices get a patch?

Some do. Several don't. Siemens has shipped fixed firmware for the newer APOGEE PXC and TALON TC lines, and recommends network isolation for the rest.

For units with no patch, Siemens tells owners to disable FTP and web services where possible (off by default on APOGEE and Desigo), put the controllers behind a correctly configured firewall, and keep them off any network touching the public internet.

Should anyone outside a plant room care?

Yes, in a limited way. These controllers keep hospital wards at the right temperature, smoke extraction running in car parks and server rooms cool. A denial of service here isn't a stolen database. It's a chiller that stops responding, or a ventilation loop that drops out until an engineer walks to the panel.

This beat keeps cycling back to the same structural problem. A 2010 ICS-CERT alert warned that researchers were finding SCADA kit sitting on the open internet, reachable through Shodan. Sixteen years on, the mitigation for unpatched Desigo units is the same instruction in different words: keep it off the internet. We covered a related pattern two days ago in our story on the ClickFix abuse of Siemens' Software Center update tool, and Siemens has now drawn ten advisories from us in the last 90 days.

My read: nobody's tied these specific bugs to a named intrusion set. No public exploit, no claimed victim. The risk is opportunistic scanning against building controllers that someone plugged straight into a public IP. Facilities teams running unpatched gear should treat the firewall guidance as the fix, because it's the only one coming.