An improper validation of user input in multipart handling on the APOGEE web service can allow an unauthenticated attacker to cause a denial of service. By sending crafted or oversized multipart payloads, the service can crash or become unresponsive, disrupting legitimate control functions without enabling code execution.

Siemens APOGEE MBC (PPC) (BACnet) and (P2 Ethernet), APOGEE MEC (PPC) (BACnet) and (P2 Ethernet), APOGEE PXC Compact (BACnet) and (P2 Ethernet) for all versions before V3.5.7 and V2.8.21 respectively, APOGEE PXC Modular (BACnet) and (P2 Ethernet) for all versions before V3.5.7 and V2.8.21, and TALON TC Compact and Modular (BACnet) for all versions before V3.5.7. These products expose a vulnerability that can be leveraged remotely over the web service that handles multipart requests.

The CVSS score of 8.7 classifies this vulnerability as high severity, and the lack of an authentication requirement allows any remote actor to trigger the denial. Because EPSS data is not available and the flaw is not listed in CISA’s KEV catalog, the current exploitation probability cannot be quantified precisely, but the remote attack surface and critical industrial context make it a significant risk. The most likely attack vector is over the web service that handles multipart requests, which can be accessed from external networks or local controllers without credentials.