{"id":"CVE-2021-27391","aliases":["EUVD-2021-14146","GHSA-98pm-v23p-r2wf"],"status":"published","title":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3),...","description":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions \u003e= V2.8), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions \u003e= V2.8), TALON TC Compact (BACnet) (All versions \u003c V3.5.3), TALON TC Modular (BACnet) (All versions \u003c V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.03369,"percentile":0.88924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2021-09-14T10:47:31Z","modified":"2026-06-17T03:44:46Z","products":[{"vendor":"siemens","product":"apogee mbc (ppc) (p2 ethernet)"},{"vendor":"siemens","product":"apogee mec (ppc) (p2 ethernet)"},{"vendor":"siemens","product":"apogee pxc compact (bacnet)"},{"vendor":"siemens","product":"apogee pxc compact (p2 ethernet)"},{"vendor":"siemens","product":"apogee pxc modular (bacnet)"},{"vendor":"siemens","product":"apogee pxc modular (p2 ethernet)"},{"vendor":"siemens","product":"apogee_mbc_\\(ppc\\)_\\(p2_ethernet\\)_firmware"},{"vendor":"siemens","product":"apogee_mec_\\(ppc\\)_\\(p2_ethernet\\)_firmware"},{"vendor":"siemens","product":"apogee_pxc_bacnet_automation_controller_firmware"},{"vendor":"siemens","product":"apogee_pxc_compact_\\(p2_ethernet\\)_firmware"},{"vendor":"siemens","product":"apogee_pxc_modular_\\(bacnet\\)_firmware"},{"vendor":"siemens","product":"apogee_pxc_modular_\\(p2_ethernet\\)_firmware"},{"vendor":"siemens","product":"talon tc compact (bacnet)"},{"vendor":"siemens","product":"talon tc modular (bacnet)"},{"vendor":"siemens","product":"talon_tc_compact_\\(bacnet\\)_firmware"},{"vendor":"siemens","product":"talon_tc_modular_\\(bacnet\\)_firmware"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-944498.pdf","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27391"},{"url":"https://github.com/advisories/GHSA-98pm-v23p-r2wf"}],"sources":{"cve":[{"id":"CVE-2021-27391","description":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions \u003e= V2.8), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions \u003e= V2.8), TALON TC Compact (BACnet) (All versions \u003c V3.5.3), TALON TC Modular (BACnet) (All versions \u003c V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.","status":"published","published":"2021-09-14T10:47:31Z","modified":"2025-04-23T19:28:38.162Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:33:04.679189Z"}],"euvd":[{"id":"EUVD-2021-14146","description":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions \u003e= V2.8), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions \u003e= V2.8), TALON TC Compact (BACnet) (All versions \u003c V3.5.3), TALON TC Modular (BACnet) (All versions \u003c V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.","status":"published","published":"2021-09-14T10:47:31Z","modified":"2025-04-23T19:28:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:05.855584Z"}],"ghsa":[{"id":"GHSA-98pm-v23p-r2wf","title":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3),...","description":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions \u003e= V2.8), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions \u003e= V2.8), TALON TC Compact (BACnet) (All versions \u003c V3.5.3), TALON TC Modular (BACnet) (All versions \u003c V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.","status":"published","published":"2022-05-24T19:14:32Z","modified":"2025-04-23T21:30:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:02:00.72042Z"}],"nvd":[{"id":"CVE-2021-27391","description":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions \u003e= V2.6.3), APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions \u003e= V2.8), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions \u003e= V2.8), TALON TC Compact (BACnet) (All versions \u003c V3.5.3), TALON TC Modular (BACnet) (All versions \u003c V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.","status":"published","published":"2021-09-14T11:15:23.913Z","modified":"2026-06-17T03:44:46.327Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:58.502206Z"}]}}