Publication Date:
Last Update:
Current Version: V1.1
CVSS v3.1 Base Score: 7.5
CVSS v4.0 Base Score: 8.7
Affected Product and Versions Remediation

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions < V3.5.7
affected by all CVEs
Update to V3.5.7 or later version

All versions < V2.8.21
affected by all CVEs
Update to V2.8.21 or later version

All versions < V3.5.7
affected by all CVEs
Update to V3.5.7 or later version

All versions < V2.8.21
affected by all CVEs
Update to V2.8.21 or later version

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions >= V2.3
affected by all CVEs
Currently no fix is available

All versions < V3.5.7
affected by all CVEs
Update to V3.5.7 or later version

All versions < V3.5.7
affected by all CVEs
Update to V3.5.7 or later version
  • Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

CVSS v3.1 Base Score 7.5
CVSS v3.1 Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0 Base Score 8.7
CVSS v4.0 Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE CWE-400: Uncontrolled Resource Consumption

Products listed in this advisory use the Nucleus RTOS (Real-time operating system).

For more details regarding the vulnerability reported for Nucleus RTOS refer to Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/pdf/ssa-313313.pdf

https://www.siemens.com/cert/advisories
V1.0 (2022-10-11): Publication Date
V1.1 (2024-05-14): Added fix for APOGEE PXC Series (BACnet), APOGEE PXC Series (P2 Ethernet), TALON TC Series (BACnet); added CVSSv4.0 vector and score