Unauthenticated Firmware Upload Vulnerability in Desigo PX Controllers

An attacker could upload malicious firmware to Desigo PXC/PXM controllers without authentication, gaining complete control over building automation systems including HVAC, lighting, and process controls, which could disrupt facility operations or alter safety-critical setpoints.

Building automation operators and facility managers using Siemens Desigo PXC or PXM controllers for HVAC, lighting, energy management, and other building systems. This affects any organization with Desigo-based building automation infrastructure in versions V4.10, V5.0, V5.10, or V6.0 running on any of the listed controller models.

An attacker on the network sends a firmware upload request to the controller's management interface (port typically 80/443 or proprietary). The controller accepts and executes the malicious firmware without verifying the attacker's identity. The attacker now has full code execution on the device.