ICSA-26-295-08: Siemens APOGEE, TALON & Desigo PXC/PXM DoS Vulnerabilities (CVE-2026-102073–102076) — Detection and Remediation Guide for Building Automation Defenders

On January 27, 2026, CISA published ICS advisory ICSA-26-295-08, disclosing multiple vulnerabilities in Siemens' building automation controller families — APOGEE, TALON, and Desigo PXC/PXM — that allow an attacker to cause denial of service and degrade the availability of affected devices. The affected products span all versions of several controller lines, and Siemens has released new firmware versions for some products while recommending specific mitigations where fixes are not yet available.

This is not an abstract IT problem. These controllers run physical infrastructure — HVAC, environmental controls, and building management systems — in hospitals, data centers, pharmaceutical manufacturing, airports, and university campuses. A successful DoS against a Desigo PXC controller in a hospital's air handler control loop, or a data center's cooling plant, translates directly into operational risk: thermal shutdowns, infection-control failures, or environmental excursions in regulated manufacturing. Availability attacks against OT are, in practice, physical attacks.

The four CVEs disclosed — CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, and CVE-2026-102076 — all affect the APOGEE MBC (PPC) controllers in both BACnet and P2 Ethernet variants, across all versions. Defenders managing building automation networks need to treat this advisory as an immediate inventory-and-segmentation exercise, not a someday patch ticket.

Technical Analysis

Affected Products

Per CISA ICSA-26-295-08, the following products and versions are confirmed affected:

The advisory also covers additional Siemens TALON and Desigo PXC/PXM product lines (see the full CISA advisory and Siemens CSAF for the complete product matrix). The breadth of the "all versions" designation is significant: these are protocol-level or platform-level flaws, not single build defects.

Vulnerability Overview

• CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076 — Multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device.

The attack surface here is the controller's network-facing protocol stack. APOGEE MBC/MEC controllers communicate over:

• BACnet — typically UDP port 47808 (0xBAC0), often with BACnet/IP broadcast traffic (BBMD configurations) that can traverse VLANs
• P2 Ethernet (PPC protocol) — Siemens' proprietary point-to-point protocol over Ethernet between controllers and the APOGEE front end

Both protocols were designed for isolated, trusted networks. They lack authentication and integrity protection, and controller firmware historically has limited resilience against malformed or high-rate protocol traffic. A DoS condition in these stacks typically manifests as controller watchdog resets, dropped field-bus communications, or complete loss of supervisory control — the BMS front end shows controllers offline while physical processes revert to last-state or fail-safe behavior.

Exploitation Requirements

An attacker needs network reachability to the controller's automation subnet. In our IR engagements, we consistently find that building automation networks are reachable from far more places than asset owners believe:

• Flat networks where the corporate LAN and BMS VLAN share a routed path
• Vendor remote-access tunnels (TeamViewer, RDP jump boxes, cellular gateways) bridged into the OT segment
• BACnet/IP broadcast domains that leak across poorly configured BBMD routers
• Compromised facility-management workstations that dual-homed IT and OT interfaces

That means the realistic attack path is: compromise any IT asset with a route to the automation VLAN → send crafted BACnet/P2 traffic → knock controllers offline. No authentication, no stealth requirement, no sophisticated exploit chain.

Exploitation Status

At time of writing there are no confirmed in-the-wild exploitation reports and these CVEs are not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. That should not be read as reassurance. OT DoS conditions in unauthenticated building-automation protocols are trivially weaponizable, and the affected devices sit in exactly the kind of high-impact environments — healthcare, critical manufacturing, data centers — that attract both opportunistic and targeted actors. The defensive window is now, before public proof-of-concept traffic appears.

Detection & Response

Detection for OT protocol abuse is challenging because most security telemetry lives on IT assets, not controllers. The practical approach: monitor at the choke points — firewalls between IT and OT, VLAN ACL logs, and the syslog feeds from network gear that can see BACnet traffic — plus host-level monitoring on BMS engineering workstations and front-end servers.

SIGMA Rules

These rules target network-level visibility. Deploy them against your firewall/NDR log pipeline (Zeek, Suricata, or firewall syslog ingested as network_connection/firewall categories). Tune allowed_bacnet_hosts to your known BMS servers and operator workstations — without that allowlist these will fire constantly.

---
title: BACnet Traffic From Non-BMS Host to Automation Controller
description: Detects BACnet/IP traffic (UDP 47808) originating from hosts outside the authorized building management system asset set. Could indicate scanning or exploitation attempts against Siemens APOGEE/TALON/Desigo controllers per ICSA-26-295-08.
author: Security Arsenal
date: 2026/01/27
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
status: experimental
tags:
  - attack.discovery
  - attack.t1046
  - attack.impact
  - attack.t0814
logsource:
  category: firewall
detection:
  selection:
    dst_port: 47808
  filter_authorized_bms:
    src_ip:
      - '10.10.5.0/24' # Replace with authorized BMS server/operator workstation subnet
  condition: selection and not filter_authorized_bms
falsepositives:
  - Misconfigured BMS integrations and new vendor equipment before asset inventory update
  - Network management platforms performing UDP discovery sweeps
level: high
---
title: High-Rate UDP Flood Toward Building Automation Controller Subnet
description: Detects abnormally high connection counts from a single source to OT/controller subnets, consistent with denial-of-service attempts against building automation devices per ICSA-26-295-08 (CVE-2026-102073 through CVE-2026-102076).
author: Security Arsenal
date: 2026/01/27
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
status: experimental
tags:
  - attack.impact
  - attack.t1499
  - attack.t0814
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 47808 # BACnet/IP
    dst_ip|startswith:
      - '10.20.30.' # Replace with controller/automation subnet prefix(es)
  condition: selection
falsepositives:
  - Legitimate BACnet broadcast traffic from BBMD routers
  - BMS front-end polling cycles (filter known front-end IPs)
level: medium
---
title: New Network Listener on BMS Engineering Workstation
description: Detects processes on building management engineering workstations or BMS front-end servers opening unexpected listening ports, which may indicate attacker staging for OT protocol abuse against Siemens controllers.
author: Security Arsenal
date: 2026/01/27
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
status: experimental
tags:
  - attack.command_and_control
  - attack.t1571
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'false'
  filter_known_services:
    Image|endswith:
      - '\\System32\\svchost.exe'
      - '\\System32\\lsass.exe'
      - '\\desigo.exe'
      - '\\Insight.exe' # Siemens Desigo/Insight front-end processes — extend per environment
  condition: selection and not filter_known_services
falsepositives:
  - Vendor remote-support tools installed during maintenance windows
  - Legitimate BMS application services added during upgrades
level: low

KQL — Microsoft Sentinel / Defender

This query hunts firewall/syslog telemetry (ingested via CEF as CommonSecurityLog) for BACnet traffic from hosts outside an authorized BMS allowlist, plus a burst-rate detector for DoS conditions. Adjust the allowlist and subnet to your environment before deploying as an analytics rule.

// Hunt 1: BACnet/IP traffic from non-authorized sources (ICSA-26-295-08)
let AuthorizedBMS = dynamic(["10.10.5.10", "10.10.5.11", "10.10.5.20"]); // BMS servers, operator workstations
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 47808
| where SourceIP !in (AuthorizedBMS)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            ConnectionCount = count(), Destinations = dcount(DestinationIP),
            DestinationSet = make_set(DestinationIP, 50)
    by SourceIP, DeviceAction
| where ConnectionCount > 50 or Destinations > 5 // scanning or flood behavior
| sort by ConnectionCount desc;
// Hunt 2: Burst-rate detector — potential DoS against controller subnets
CommonSecurityLog
| where TimeGenerated > ago(6h)
| where DestinationPort == 47808
| summarize EventsPerMinute = count() by bin(TimeGenerated, 1m), SourceIP
| where EventsPerMinute > 500 // baseline first; legitimate BMS polling is steady and predictable
| sort by EventsPerMinute desc;
// Hunt 3: Endpoint telemetry — new processes on BMS workstations making OT-segment connections
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort == 47808
| join kind=inner (DeviceInfo | where DeviceName contains "BMS" or DeviceName contains "FAC") on DeviceId
| summarize Connections = count(), Targets = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where InitiatingProcessFileName !in~ ("desigo.exe", "insight.exe", "svchost.exe") // extend with known BMS processes

Velociraptor VQL

Use this artifact to hunt BMS front-end servers and engineering workstations for unexpected processes holding connections into the controller network, and for unusual listening sockets that could indicate attacker staging.

-- Hunt BMS front-end hosts for unexpected processes with connections to the OT segment
-- and non-standard listening sockets (ICSA-26-295-08 staging detection)
SELECT Pid, Name, Address AS LocalAddr, Port AS LocalPort,
       Status, RemoteAddr, RemotePort, Family, Type
FROM netstat()
WHERE (RemotePort = 47808 OR LocalPort = 47808)
   OR (Status =~ 'LISTEN'
       AND Name !~ '(?i)(svchost|lsass|system|desigo|insight|sqlservr)')

Remediation / Verification Script

Run this from a management host to inventory which devices on your network are speaking BACnet (UDP 47808), and to verify whether controller-facing ports are reachable from segments where they shouldn't be. The PowerShell version audits a Windows BMS server; the Bash version sweeps from a Linux sensor or jump host.

# Audit local BACnet exposure and listener state on a BMS front-end / engineering workstation
Write-Host "=== BACnet (UDP 47808) endpoint check ===" -ForegroundColor Cyan
Get-NetUDPEndpoint -LocalPort 47808 -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{N='ProcessName';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
  Format-Table -AutoSize

# Check inbound firewall rules that permit traffic INTO OT-adjacent ports
Write-Host "=== Inbound firewall rules permitting BACnet ===" -ForegroundColor Cyan
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True |
  Get-NetFirewallPortFilter |
  Where-Object { $_.LocalPort -eq 47808 -or $_.RemotePort -eq 47808 } |
  Format-Table DisplayName, Profile, Protocol, LocalPort, RemotePort -AutoSize

# Export controller inventory: ARP/DHCP neighbors on the automation VLAN for asset validation
Write-Host "=== Neighbor table (validate against OT asset inventory) ===" -ForegroundColor Cyan
Get-NetNeighbor | Where-Object { $_.State -in @('Reachable','Stale') } |
  Select-Object IPAddress, LinkLayerAddress, InterfaceAlias, State |
  Sort-Object InterfaceAlias | Format-Table -AutoSize

#!/bin/bash
# BACnet exposure sweep — run from an authorized management host only
# Discovers BACnet/IP responders (UDP 47808) on target subnets to validate the OT asset inventory
# for ICSA-26-295-08 remediation scoping. Requires nmap.
SUBNETS="192.168.50.0/24 192.168.51.0/24"   # Replace with your automation VLANs
OUTFILE="bacnet_inventory_$(date +%Y%m%d).txt"

echo "=== BACnet/IP device discovery (UDP 47808) ===" | tee "$OUTFILE"
for NET in $SUBNETS; do
  echo "--- Scanning $NET ---" | tee -a "$OUTFILE"
  nmap -sU -p 47808 --script bacnet-info "$NET" -oG - 2>/dev/null | tee -a "$OUTFILE"
done

echo ""
echo "=== Cross-check: which hosts CAN route to controller subnets? ===" | tee -a "$OUTFILE"
ip route | grep -E "192\.168\.(50|51)" | tee -a "$OUTFILE"

echo ""
echo "Next steps: reconcile discovered devices against Siemens advisory product list;"
echo "isolate any APOGEE MBC/MEC (PPC) BACnet or P2 Ethernet controllers pending firmware update."

Remediation

1. Consult the official advisories immediately. Pull the full product/version matrix from CISA ICSA-26-295-08 and the linked Siemens CSAF document. Siemens has released updated versions for several affected products — identify your exact controller models (MBC, MEC, PXC, PXM variants) and map them to the fixed releases.
2. Patch what can be patched — in maintenance windows, with vendor coordination. Building automation firmware updates carry operational risk; schedule through your Siemens service channel or system integrator, and validate controller failover behavior before touching production air handlers or data-center cooling loops.
3. Apply Siemens' documented mitigations where fixes are not yet available. For products without a released fix, Siemens recommends specific compensating controls in the advisory. These are your bridge controls — document them, assign owners, and track them against the fix release.
4. Segment the automation network now. This is the single highest-value mitigation for unauthenticated-protocol DoS flaws:
   • Place all BACnet/P2 controller traffic behind a firewall with default-deny inbound rules; permit only known BMS front-end and operator workstation IPs to reach UDP 47808 and P2 ports.
   • Disable BACnet/IP broadcast forwarding (BBMD) across segment boundaries unless operationally required.
   • Block direct internet access from controllers — CISA's standing OT guidance: no control-system device should be internet-reachable.
5. Kill unauthorized remote access paths. Audit vendor VPNs, cellular gateways, and remote-support tools bridging into the BMS network. Require MFA, jump-host architecture, and session recording for any vendor maintenance access.
6. Baseline and monitor. Legitimate BMS traffic is steady and predictable — polling cycles at fixed intervals from fixed hosts. Any deviation (new sources, rate spikes, broadcast storms) is a high-fidelity signal once baselined. Deploy the detection content above after a one-to-two-week baseline.
7. Test your availability story. Ask the hard question in your next tabletop: if every controller on a floor drops offline simultaneously, what fails? Do AHUs revert to local control? Does the data center have thermal headroom? Know the physical consequences before an attacker teaches you.
8. Update your asset inventory. "All versions affected" advisories are an inventory-forcing function. If you cannot enumerate every MBC/MEC/PXC/PXM controller, its firmware, and its network path within 24 hours, that gap is your real vulnerability.

Conclusion

ICSA-26-295-08 is a reminder that availability attacks against building automation don't require zero-days — they require reachability. CVE-2026-102073 through CVE-2026-102076 affect every version of core Siemens controller lines deployed across critical facilities worldwide. Siemens has fixes for some products and mitigations for the rest; your job is to know exactly which controllers you own, shrink their exposure surface, and build detection around the choke points. The organizations that treat BMS networks as untrusted, segmented, monitored infrastructure will absorb this class of threat. The ones running flat networks behind a vendor RDP session will learn about it the hard way.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub