OTPulse

Siemens Nucleus RTOS-based APOGEE and TALON Products (Update C)

Plan PatchCVSS 9.8ICS-CERT ICSA-21-315-07Nov 9, 2021
SiemensWAGOManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple vulnerabilities (NUCLEUS:13) in the Nucleus RTOS used by Siemens APOGEE, TALON, and Desigo building automation controllers. These include memory corruption flaws (buffer overflows, out-of-bounds access), integer overflows, and input validation errors in DHCP, FTP, and other protocol implementations. An attacker with network access can send crafted protocol packets to trigger code execution or denial of service. Siemens has released patches for most recent product lines but has no fixes available for end-of-life APOGEE MBC/MEC (PPC) models.

What this means
What could happen
Multiple memory corruption and input validation vulnerabilities in these Siemens building automation controllers could allow an attacker on the network to execute arbitrary code or crash the device, disrupting HVAC, lighting, or other critical building systems.
Who's at risk
Building automation operators—particularly those managing HVAC, lighting, and environmental controls in facilities. Affects Siemens APOGEE and TALON controllers (MBC, MEC, PXC, and TC models) and Desigo PXC series controllers used in commercial buildings and campuses. The APOGEE MBC and MEC (PPC) models are end-of-life with no patch available, making them a persistent risk.
How it could be exploited
An attacker with network access to the device can send malformed DHCP packets, FTP commands, or other network protocol messages that trigger memory corruption bugs in the Nucleus RTOS kernel. Successful exploitation gives the attacker code execution with device privileges, allowing them to modify setpoints, disable alarms, or stop the controller entirely.
Prerequisites
  • Network access to the device (port 67 for DHCP, port 21 for FTP, or other affected protocol ports)
  • No authentication required—vulnerabilities are in protocol parsing before credential checks
  • Device must be running a vulnerable Nucleus RTOS version
remotely exploitableno authentication requiredlow complexityaffects critical building control systemssome products have no patch availablemultiple CVEs in same underlying component
Exploitability
Some exploitation risk — EPSS score 3.4%
Affected products (48)
21 with fix21 pending6 EOL
ProductAffected VersionsFix Status
Nucleus ReadyStart V3< V2017.02.42017.02.4
Nucleus ReadyStart V4< V4.1.14.1.1
Nucleus NETAll versionsNo fix (EOL)
Nucleus Source CodeAll versionsNo fix (EOL)
750-331≤ FW16No fix yet
Remediation & Mitigation
0/9
Do now
0/4
APOGEE MBC (PPC) (BACnet)
WORKAROUNDFor APOGEE MBC and MEC (PPC) models with no available patch: disable DHCP and use static IP addressing
WORKAROUNDFor APOGEE MBC and MEC (PPC) models with no available patch: disable FTP service
All products
WORKAROUNDDisable DHCP client and configure static IP addresses on all affected devices (unless already disabled by default)
WORKAROUNDDisable FTP service on all affected devices that have it enabled (note: disabled by default on Desigo products)
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

APOGEE PXC Compact (P2 Ethernet)
HOTFIXUpdate APOGEE PXC Compact and Modular (P2 Ethernet) to firmware version 2.8.19 or later; contact Siemens for support
APOGEE PXC Compact (BACnet)
HOTFIXUpdate APOGEE PXC Compact and Modular (BACnet) and TALON TC Compact and Modular (BACnet) to firmware version 3.5.4 or later; contact Siemens for support
All products
HOTFIXUpdate Desigo products to firmware version 6.30.016 or later
Mitigations - no patch available
0/2
The following products have reached End of Life with no planned fix: Nucleus NET, Nucleus Source Code, APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet). Apply the following compensating controls:
HARDENINGPlace all affected devices behind a firewall and restrict network access to only necessary ports and authorized subnets
HARDENINGIsolate building automation network from corporate IT network using network segmentation or air-gapping
View full CISA ICS-CERT advisory
API: /api/v1/advisories/79c2c975-09d7-4534-b7ea-6b3be67b03d2

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.