CVE-2026-102073 in APOGEE MBC
Summary
by MITRE • 10/13/2026
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability affects multiple Honeywell APOGEE and TALON building automation system devices, including MBC, MEC, PXC Compact, PXC Modular, and TALON TC models utilizing BACnet or P2 Ethernet interfaces across various firmware versions. This security flaw resides within the web service component of these industrial control systems and is characterized by an improper validation of user-controllable input length. The core technical issue stems from a failure to enforce strict bounds checking on data received through network requests, which allows attackers to supply payloads that exceed expected buffer limits or processing thresholds without triggering appropriate error handling mechanisms. This lack of rigorous input sanitization creates a critical entry point for malicious actors targeting the operational technology layer of facility management infrastructure.
From an offensive security perspective, this vulnerability maps directly to CWE-120, Buffer Copy without Checking Size of Input Classic Buffer Overflow, and potentially CWE-787, Out-of-bounds Write if memory corruption occurs beyond allocated boundaries. In the context of industrial control systems, such flaws are particularly dangerous because they can be exploited remotely by unauthenticated attackers who do not require valid credentials to initiate an attack. The absence of authentication requirements significantly lowers the barrier for entry, allowing any entity with network access to attempt exploitation. This aligns with ATT&CK tactic T1498 Network Denial of Service and techniques related to resource exhaustion or memory corruption that can lead to system instability.
The operational impact of this vulnerability is twofold, presenting both confidentiality risks and availability threats. An unauthenticated remote attacker may exploit the input validation failure to read portions of device memory. This capability could potentially expose sensitive configuration data, proprietary algorithms, or network topology information stored within the embedded systems of these controllers. Such information disclosure can facilitate further reconnaissance and more sophisticated attacks against the broader building automation network. Furthermore, the vulnerability enables denial-of-service conditions by causing the web service or underlying operating system to crash due to memory corruption or resource exhaustion. In a critical infrastructure environment like HVAC control for large commercial buildings, such disruptions can lead to significant operational downtime, loss of environmental control, and potential safety hazards if backup systems fail to engage automatically.
Mitigation strategies must focus on immediate patching and network segmentation until updates are applied. Honeywell has released firmware versions V3.5.7 and later for BACnet-based devices (APOGEE PXC Compact/Modular, TALON TC) and V2.8.21 or later for P2 Ethernet variants to address this issue. Administrators should prioritize upgrading all affected appliances to these patched versions immediately. In environments where immediate patching is not feasible due to operational constraints, network segmentation is recommended to restrict access to the web service interfaces of these devices from untrusted networks. Implementing strict firewall rules that limit inbound connections to authorized management stations only can reduce the attack surface significantly. Additionally, enabling logging and monitoring for anomalous HTTP requests or unusual traffic patterns targeting these specific device models can aid in early detection of exploitation attempts while long-term remediation plans are executed.