[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-siemens-has-no-fix-planned-for-building-controller-flaw":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12213,"siemens-has-no-fix-planned-for-building-controller-flaw","Siemens Has No Fix Planned for Building Controller Flaw","Siemens lists five CVEs across APOGEE, TALON and Desigo controllers, and for one it plans no patch, leaving network segmentation as the defense.","Siemens has no patch planned for CVE-2026-89208, a flaw in building automation controllers, and tells customers to wall the devices off instead.\n\nThe advisory covers five vulnerabilities across Siemens APOGEE, TALON and Desigo PXC\u002FPXM products. Four of them, CVE-2026-102073 through CVE-2026-102076, affect the APOGEE MBC (PPC) and MEC (PPC) controllers in both BACnet and P2 Ethernet variants, in all versions. The fifth, CVE-2026-89208, affects the APOGEE PXC Compact (BACnet), the TALON TC Compact (BACnet) and more than a dozen Desigo PXC and PXM models running version 2.3 or later.\n\nThe advisory says the flaws could let an attacker cause a denial of service and potentially hurt the availability of a device. One entry, CVE-2026-102073, is described more specifically: the web service does not properly check the length of user-controlled input, so an unauthenticated remote attacker could read portions of device memory or trigger a denial of service. Siemens said it has released new versions for several affected products and recommends updating. The advisory does not say which ones.\n\nFor the CVE-2026-89208 products, the listed remedy is a mitigation: apply network segmentation and put the controllers behind properly configured gateways or firewalls. The entries for the APOGEE MBC controllers add a second step, disabling the FTP\u002FWeb service, which the advisory notes is off by default on APOGEE, Desigo and TALON products.\n\nThat default matters. Exposure here likely depends on whether someone switched the service on, though the advisory does not spell that out. These controllers run heating, ventilation and air conditioning, and such hardware tends to stay in buildings far longer than office IT. A no-patch outcome is a common ending for that kind of gear, which leaves the network layout, not the firmware, as the real control.","[\"siemens\",\"ics-security\",\"building-automation\",\"vulnerabilities\"]","2026-10-22T12:00:00.000Z","2026-10-22T21:16:21.929Z","2026-10-22T21:16:24.218Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Fix three problems: (1) the 'published October 22' date appears nowhere in the source, so verify it or cut it; (2) 'Another scored entry' with the 5.3 CVSS and out-of-bounds read is an unnamed reference, so say which CVE it belongs to (the source ties CWE-125 and the 5.3 score, which is a confidentiality-only vector, to the advisory without clear attribution) or drop it; (3) 'worst outcome is denial of service' sits awkwardly beside the memory-read claim, so state the impact consistently, and cu","resolved","security",[32,33,34,35],"siemens","ics-security","building-automation","vulnerabilities",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-295-08",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7065,"2026-10-22T21:51:25.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1057,"2026-10-22T15:11:26.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",574,"2026-10-22T20:23:48.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",559,"2026-10-22T21:00:00.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",288,"2026-10-22T17:25:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",285,"2026-10-22T22:21:59.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",216,"2026-10-22T22:12:19.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",144,"2026-10-22T23:15:00.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",142,"2026-10-23T00:09:58.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",98,"2026-10-22T21:07:09.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",88,"2026-10-22T22:25:33.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]