A coding flaw in the upload component of the Siemens APOGEE family prevents proper validation of user supplied data. This weakness allows an attacker who does not need authentication to send crafted requests that trigger a resource exhaustion or crash of the web service, resulting in a denial of service. The flaw does not provide elevation of privileges or data disclosure, but it disrupts the availability of the affected control systems.

The vulnerability affects multiple Siemens products across the APOGEE and TALON series. Specifically, all versions of APOGEE MBC (PPC) and APOGEE MEC (PPC) for both BACnet and P2 Ethernet protocols, all versions of APOGEE PXC Compact and PXC Modular below V3.5.7 for BACnet and below V2.8.21 for P2 Ethernet, and all versions of TALON TC Compact and TC Modular below V3.5.7 for BACnet. Network administrators should verify the model and firmware version of each device to determine exposure.

The CVSS score of 8.7 classifies this issue as High severity, and the vulnerability can be exploited remotely without authentication. While an EPSS score is not available, the simplicity of input manipulation and remote reachability suggest a realistic attack potential. The flaw is not currently listed in the CISA KEV catalog, but its existence on widely deployed industrial control equipment warrants immediate attention. A threat actor compromising any service that accepts uploads could cause widespread downtime in critical manufacturing or building automation processes.