The vulnerability stems from the Siemens APOGEE device web service failing to validate the length of user‑controllable input. Because the input length is unchecked, a crafted request can trigger an overflow or other memory corruption that allows an attacker without authentication to read arbitrary portions of the device’s memory or to exhaust resources and force the service to crash. Based on the description, it is inferred that the lack of validation could lead to an integer overflow or buffer overflow, which is why the weakness is identified as CWE‑191.

Affected products are Siemens APOGEE MBC (PPC) for BACnet and P2 Ethernet, Siemens APOGEE MEC (PPC) for BACnet and P2 Ethernet, Siemens APOGEE PXC Compact for BACnet versions lower than 3.5.7 and for P2 Ethernet versions lower than 2.8.21, Siemens APOGEE PXC Modular for BACnet lower than 3.5.7 and for P2 Ethernet lower than 2.8.21, Siemens TALON TC Compact for BACnet versions lower than 3.5.7, and Siemens TALON TC Modular for BACnet lower than 3.5.7. No versions are listed as having the input‑length validation fix, so all of the stated versions are considered vulnerable.

The CVSS base score is 8.8, indicating high severity. No EPSS score is available, and the issue is not yet listed in the CISA KEV catalog. The likely attack vector is an unauthenticated network attacker who can send malformed requests over an exposed BACnet or P2 Ethernet interface; this is inferred from the description that the flaw is triggered by user‑controlled input received over those protocols. Exploiting the bug requires only network connectivity to the affected interface and does not require authentication, making the vulnerability readily exploitable in realistic operational environments.