Siemens APOGEE PXC / MEC / MBC and TALON TC BACnet and P2 automation controllers: A cluster of critical flaws

Impact

A cluster of critical flaws in the Siemens field controllers that actually drive air handling units, VAV boxes and chilled-water valves, including unauthenticated paths to the integrated web server and memory-safety issues reachable over the network. Compromise of an APOGEE or TALON controller is compromise of the physical actuator layer: fan enable, damper position, valve position, setpoint. There is no supervisory system to overrule it because the controller is the thing that closes the loop. The older companion issue (CVE-2017-9946) lets an attacker bypass authentication on the embedded web server and pull configuration off the device, which hands over the point map needed to make the attack surgical. In a GPU hall, an attacker who owns the AHU controllers can drive inlet temperatures past the accelerator shutdown threshold in minutes and, by holding valve position, keep them there.

Who can reach it

Network access to the controller's HTTP/HTTPS ports (80/443) on the facility network. These are wall-mounted controllers in mechanical rooms and ceiling spaces, on a flat building VLAN with no port security in the overwhelming majority of sites. Physical access to the panel is also a real vector because these are often in unlocked or shared mechanical spaces that tenant security policy does not cover.

What to do

Firmware upgrade per Siemens SSAs - APOGEE PXC Compact/Modular to V3.5.4+ (BACnet) or V2.8.19+ (P2), TALON TC accordingly. That is a per-controller flash by a Siemens-certified technician, with each AHU losing automatic control during its flash, so it is a genuine maintenance-window project measured in technician-days across a large site and one that most operators will keep deferring. Because of that, the load-bearing control is network isolation: controllers on a dedicated VLAN, HTTP/HTTPS permitted only from the supervisory station, and physical locks on mechanical rooms and control panels. If you lease, these are the landlord's controllers - ask for the firmware baseline, and if the answer is 'all versions' assume the cluster applies.

References