ICSA-25-135-14: Siemens APOGEE PXC and TALON TC Series

Summary

APOGEE PXC and TALON TC Series (BACnet) Devices devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation. Siemens recommends countermeasures for products where fixes are not, or not yet available. CVE-2025-40555: Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-25-135-14
Status: Final · version 1
Initial release: 2025-05-13
Last revised: 2025-05-13
Vendor: Siemens
Critical infrastructure sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Deployed: Worldwide
Vendor headquarters: Germany

Republished vendor advisory. This ICSA is a verbatim republication of Siemens ProductCERT SSA-718393 from a direct conversion of their vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…

General Recommendations: As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Credit: Siemens ProductCERT

Affected products (1)

APOGEE PXC+TALON TC Series (BACnet) — all versions

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2025-40555	CWE-440 Expected Behavior Violation	4.7 Medium	CVE-2025-40555 Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation. No fix planned: Currently no fix is planned Affected, fixed & timeline Affected: APOGEE PXC+TALON TC Series (BACnet) all versions

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-40555	4.7 Medium	Siemens APOGEE PXC+TALON TC Series (BACnet) A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sending unsolicited BACnet broadcas…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Siemens 2 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.

CyberzSOC