The vulnerability originates in the FTP service of several Siemens APOGEE and TALON devices, where input length is not properly checked. An unauthenticated remote attacker can send an oversized command, triggering a stack‑based buffer overflow (CWE‑121) that causes the service to crash. The immediate result is a denial of service, rendering the affected control functions unavailable until the device is restarted or updated.

Affected systems include Siemens APOGEE MBC (PPC) for BACnet and P2 Ethernet, APOGEE MEC (PPC) for BACnet and P2 Ethernet, APOGEE PXC Compact and Modular across BACnet and P2 Ethernet interfaces, as well as TALON TC Compact and TALON TC Modular over BACnet. Vulnerable firmware versions are all releases before V3.5.7 for the PXC Compact/Modular and all TALON variants, and before V2.8.21 for the PXC P2 Ethernet models.

With a CVSS score of 8.7, this flaw is considered high severity. The EPSS score is not available, and it is not listed in CISA's KEV catalog, so no confirmed exploits have been reported yet. The attack vector is remote, unauthenticated, via the exposed FTP port, making automated discovery possible. The lack of input validation raises the likelihood of exploitation by attackers using simple scans, potentially causing widespread availability disruption on networks that host unprotected Siemens devices.