Siemens APOGEE PXC and TALON TC Series Information Disclosure Vulnerability

A vulnerability exists in all versions of Siemens APOGEE PXC Series (BACnet), APOGEE PXC Series (P2 Ethernet), and TALON TC Series (BACnet) devices. These devices allow unrestricted access to sensitive files, including databases, over the network. This vulnerability could enable an attacker to download an encrypted database file containing passwords.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, specifically encrypted database files containing passwords.

Remediation

Siemens is working on a fix for this vulnerability but has not yet released one. In the meantime, it is recommended to change all default passwords, use strong passwords for all accounts, and disable telnet if it has been enabled.