CVE-2026-102074 in APOGEE MBC
Summary
by MITRE • 10/13/2026
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability affects multiple Honeywell APOGEE and TALON building automation system devices, specifically those utilizing BACnet or P2 Ethernet protocols with firmware versions prior to the specified patches for PXC Compact, PXC Modular, and TALON TC models. The core technical flaw resides within the File Transfer Protocol service implemented on these embedded systems, where there is a failure to properly validate the length of user-controllable input data during transmission processing. This lack of boundary checking constitutes an Improper Input Validation weakness, which aligns with CWE-20 in the Common Weakness Enumeration taxonomy. When an unauthenticated remote attacker interacts with this service, they can supply crafted packets containing excessively long or malformed payload lengths that exceed the expected buffer limits allocated by the application logic.
Because the input validation mechanism is absent or insufficiently robust, the processing of these oversized inputs leads to a memory corruption event within the device's operating environment. This typically manifests as a stack-based buffer overflow or heap corruption, depending on how the FTP service handles the incoming data stream internally. The immediate operational impact of this flaw is a denial of service condition for the affected building automation controller. Upon receiving the malicious input, the application may crash, freeze, or trigger an automatic reboot sequence to recover from the fault state. In critical infrastructure environments such as commercial buildings, hospitals, or industrial facilities, where these controllers manage HVAC systems, lighting, and access control, a denial of service can lead to significant operational disruptions, potential safety hazards due to loss of environmental controls, and increased maintenance costs associated with device resets and troubleshooting.
From an attack vector perspective, this vulnerability is classified under the ATT&CK framework technique T1498 Network Denial of Service, as it allows for resource exhaustion or service disruption through direct exploitation rather than complex privilege escalation chains. The fact that no authentication is required to trigger this condition significantly lowers the barrier for entry, allowing any network-connected entity with access to the management VLAN or subnet where these devices reside to exploit the flaw. This highlights a critical security design oversight in legacy building automation systems, which often prioritize operational availability and interoperability over strict input sanitization protocols common in general-purpose IT infrastructure.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary corrective action is to apply the vendor-released firmware updates immediately for all affected models: version V3.5.7 or later for APOGEE PXC Compact, TALON TC Compact, and TALON TC Modular devices using BACnet; and version V2.8.21 or later for those utilizing P2 Ethernet connections. For the APOGEE MBC and MEC series with PPC processors running on all versions of both protocols, immediate patching is also required as no specific version exemption was listed implying they are fully vulnerable until a future update addresses this specific FTP service flaw. In environments where updating firmware is not immediately feasible due to operational constraints or testing requirements, network segmentation should be enforced to restrict access to the management interfaces and FTP services of these devices exclusively to trusted administrative subnets using firewall rules or VLAN isolation. Additionally, deploying intrusion detection systems configured with signatures for buffer overflow attempts can provide an additional layer of monitoring and potential alerting against exploitation activities targeting this specific input validation weakness.