OTPulse

Siemens APOGEE, TALON and Desigo PXC/PXM Products

Plan PatchCVSS 8.2ICS-CERT ICSA-26-295-08Oct 13, 2026
Siemens
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.

What this means
What could happen
Could allow an attacker to read sensitive memory contents
Who's at risk
Organizations in critical infrastructure using Siemens equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device without any credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (23)
6 with fix17 EOL
ProductAffected VersionsFix Status
Desigo PXC00-U >= V2.3≥ 2.3No fix (EOL)
Desigo PXC001-E.D >= V2.3≥ 2.3No fix (EOL)
Desigo PXC100-E.D >= V2.3≥ 2.3No fix (EOL)
Desigo PXC12-E.D >= V2.3≥ 2.3No fix (EOL)
Desigo PXC128-U >= V2.3≥ 2.3No fix (EOL)
Remediation & Mitigation
0/6
Do now — compensating controls
0/1
WORKAROUNDDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

UPGRADEUpdate to V2.8.21 or later version
UPGRADEUpdate to V3.5.7 or later version
Mitigations - no patch available
0/3
The following products have reached End of Life with no planned fix: Desigo PXC00-U >= V2.3, Desigo PXC001-E.D >= V2.3, Desigo PXC100-E.D >= V2.3, Desigo PXC12-E.D >= V2.3, Desigo PXC128-U >= V2.3, Desigo PXC200-E.D >= V2.3, Desigo PXC22-E.D >= V2.3, Desigo PXC22.1-E.D >= V2.3, Desigo PXC36.1-E.D >= V2.3, Desigo PXC50-E.D >= V2.3, Desigo PXC64-U >= V2.3, Desigo PXM20-E >= V2.3, Desigo PXC00-E.D >= V2.3, APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet). Apply the following compensating controls:
HARDENING CVE-2026-89208
HARDENING- Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
HARDENINGCurrently no fix is planned
View full CISA ICS-CERT advisory
API: /api/v1/advisories/2581b3b2-eec5-41ba-b0aa-94b9681b540c

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Siemens APOGEE, TALON and Desigo PXC/PXM Products | CVSS 8.2 - OTPulse