Siemens APOGEE PXC+TALON TC BACnet Broadcast Message expected behavior violation

Summaryinfo

A vulnerability was found in Siemens APOGEE PXC+TALON TC. It has been classified as problematic. This affects an unknown part of the component BACnet Broadcast Message Handler. Performing a manipulation results in expected behavior violation. This vulnerability is reported as CVE-2025-40555. The attacker must have access to the local network to execute the attack. No exploit exists.

Detailsinfo

A vulnerability was found in Siemens APOGEE PXC+TALON TC (unknown version). It has been classified as problematic. This affects an unknown code block of the component BACnet Broadcast Message Handler. The manipulation with an unknown input leads to a expected behavior violation vulnerability. CWE is classifying the issue as CWE-440. A feature, API, or function does not perform according to its specification. This is going to have an impact on availability. The summary by CVE is:

A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation.

It is possible to read the advisory at cert-portal.siemens.com. This vulnerability is uniquely identified as CVE-2025-40555 since 04/16/2025. The exploitability is told to be easy. Access to the local network is required for this attack. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/13/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Siemens

Name

• APOGEE PXC+TALON TC

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion