- CISA's advisory says Siemens APOGEE, TALON and Desigo PXC/PXM products have flaws that could cause a denial of service.
- Siemens released fixes for some versions. For others the advisory says no fix is currently planned.
- Leaders should ask which controllers cannot be updated, whether they are isolated, and whether the FTP/Web service is on.
When the plan is the network, not the patch
Most security budgets assume that a flaw leads to an update. This advisory shows a case where it may not. For some devices, the vendor's answer is to change how they are connected, not to change the software.
CISA published advisory ICSA-26-295-08 on October 22. It names three Siemens building-automation families: APOGEE, TALON and Desigo PXC/PXM. The advisory says the listed products contain several flaws. An attacker could use them to cause a denial of service and hurt the availability of a device. Siemens has issued updated software for a number of the affected products. For others, the advisory repeatedly states: "Currently no fix is planned."
What the advisory says to do
Where fixes exist, the advisory points to updates: V3.5.7 or later for some entries, and V2.8.21 or later for others.
The advisory text WebPulse reviewed was cut short and repeats its entries. This story therefore does not match each version to a fix. A reader should check the full advisory for exact versions.
For the devices without a fix, Siemens recommends mitigations. The first is to apply network segmentation and place the controllers behind properly configured gateways or firewalls. That mitigation is listed against CVE-2026-89208. The advisory text shown does not give a score or a description for that CVE.
For many entries, Siemens also recommends disabling the FTP/Web service. According to the advisory, APOGEE, Desigo and TALON products ship with that service switched off. Teams should still confirm that nobody turned it on.
How these weaknesses work
The advisory names three types of programming weakness. It does not say which one maps to which CVE, or how each leads to a denial of service.
CWE-125 is an out-of-bounds read. The software reads memory beyond the area it was meant to use. CWE-191 is an integer underflow. A number drops below the lowest value it can hold and wraps around to a very large one. CWE-121 is a stack-based buffer overflow. The software writes more data into a fixed block of memory than the block can hold.
In general, flaws of these kinds can make a device crash or stop responding. That fits the advisory's description of a denial of service. The advisory describes the effect as one on availability.
The decision this forces
The lesson here is that a controller without a fix is a different kind of asset. It stops being a patching task and becomes a lifecycle decision. Someone must decide whether to isolate it, keep it, or replace it.
Isolation is a real control, but it depends on discipline. Segmentation only works if the firewall rules stay correct, and if nobody adds a convenient route later. The person who owns that rule may not be the person who owns the controller. That is worth checking.
For the operations or facilities team, a denial of service means the device stops doing its job. The advisory does not describe what each controller runs. Each organisation needs to know what depends on its own.
Questions to put to your team
Ask for an inventory of every APOGEE, TALON and Desigo PXC/PXM controller, with its version. Ask which of them fall under "no fix planned".
Ask who owns the firewall rules around those controllers, and when they were last reviewed. Ask whether any of the devices can be reached from the corporate network or the internet.
Ask whether the FTP/Web service is turned on anywhere. Finally, ask whether replacement of unfixable units has a date and a budget, or only a hope.
A patch ends a risk. A segmentation rule only holds it back, and someone has to keep checking that it still holds.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA.
