{"id":"CVE-2022-45937","aliases":["EUVD-2022-48779","GHSA-p69w-f9ww-g922"],"status":"published","title":"A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions \u003c V3.5.5), APOGEE...","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00653,"percentile":0.5164,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2022-12-13T00:00:00Z","modified":"2026-06-17T05:11:03Z","products":[{"vendor":"siemens","product":"apogee pxc compact (bacnet)"},{"vendor":"siemens","product":"apogee pxc compact (p2 ethernet)"},{"vendor":"siemens","product":"apogee pxc modular (bacnet)"},{"vendor":"siemens","product":"apogee pxc modular (p2 ethernet)"},{"vendor":"siemens","product":"pxc00-e96.a_firmware"},{"vendor":"siemens","product":"pxc100-e96.a_firmware"},{"vendor":"siemens","product":"pxc16.2-pe.a_firmware"},{"vendor":"siemens","product":"pxc24.2-pe.a_firmware"},{"vendor":"siemens","product":"pxc24.2-pef.a_firmware"},{"vendor":"siemens","product":"pxc24.2-per.a_firmware"},{"vendor":"siemens","product":"pxc24.2-perf.a_firmware"},{"vendor":"siemens","product":"pxx-485.3_firmware"},{"vendor":"siemens","product":"talon tc compact (bacnet)"},{"vendor":"siemens","product":"talon tc modular (bacnet)"},{"vendor":"siemens","product":"talon_tc_modular_\\(bacnet\\)_firmware"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45937"},{"url":"https://github.com/advisories/GHSA-p69w-f9ww-g922"}],"sources":{"cve":[{"id":"CVE-2022-45937","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-21T13:43:23.146Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-48779","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-21T13:43:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:52:19.235376Z"}],"ghsa":[{"id":"GHSA-p69w-f9ww-g922","title":"A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions \u003c V3.5.5), APOGEE...","description":"A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Series (P2 Ethernet) (All versions \u003c V2.8.20), TALON TC Series (BACnet) (All versions \u003c V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.","status":"published","published":"2022-12-13T18:30:34Z","modified":"2023-08-08T12:30:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:54:43.567376Z"}],"nvd":[{"id":"CVE-2022-45937","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.","status":"published","published":"2022-12-13T16:15:24.893Z","modified":"2026-06-17T05:11:03.42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:33.649381Z"}]}}