{"id":"CVE-2021-27391","state":"PUBLISHED","title":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet)","description":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.","publishedAt":"2021-09-14T10:47:31.000Z","updatedAt":"2025-04-23T19:28:38.162Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"siemens","products":["Siemens APOGEE MBC (PPC) (P2 Ethernet)","Siemens APOGEE MEC (PPC) (P2 Ethernet)","Siemens APOGEE PXC Compact (BACnet)","Siemens APOGEE PXC Compact (P2 Ethernet)","Siemens APOGEE PXC Modular (BACnet)","Siemens APOGEE PXC Modular (P2 Ethernet)","Siemens TALON TC Compact (BACnet)","Siemens TALON TC Modular (BACnet)"],"affected":[{"vendor":"Siemens","product":"APOGEE MBC (PPC) (P2 Ethernet)","versions":[{"version":"All versions >= V2.6.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE MEC (PPC) (P2 Ethernet)","versions":[{"version":"All versions >= V2.6.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Compact (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Compact (P2 Ethernet)","versions":[{"version":"All versions >= V2.8","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Modular (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Modular (P2 Ethernet)","versions":[{"version":"All versions >= V2.8","status":"affected"}]},{"vendor":"Siemens","product":"TALON TC Compact (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]},{"vendor":"Siemens","product":"TALON TC Modular (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]}],"references":["https://cert-portal.siemens.com/productcert/pdf/ssa-944498.pdf"],"weaknesses":["CWE-120"],"ingestedAt":"2026-10-29T19:48:15.637Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/27xxx/CVE-2021-27391.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-27391","state":"PUBLISHED","datePublished":"2021-09-14T10:47:31.000Z","dateUpdated":"2025-04-23T19:28:38.162Z","assignerShortName":"siemens","assignerOrgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77","dateReserved":"2021-02-18T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges."}],"affected":[{"vendor":"Siemens","product":"APOGEE MBC (PPC) (P2 Ethernet)","versions":[{"version":"All versions >= V2.6.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE MEC (PPC) (P2 Ethernet)","versions":[{"version":"All versions >= V2.6.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Compact (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Compact (P2 Ethernet)","versions":[{"version":"All versions >= V2.8","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Modular (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]},{"vendor":"Siemens","product":"APOGEE PXC Modular (P2 Ethernet)","versions":[{"version":"All versions >= V2.8","status":"affected"}]},{"vendor":"Siemens","product":"TALON TC Compact (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]},{"vendor":"Siemens","product":"TALON TC Modular (BACnet)","versions":[{"version":"All versions < V3.5.3","status":"affected"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-944498.pdf","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"siemens","dateUpdated":"2021-09-14T10:47:31.000Z","orgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"productcert@siemens.com","ID":"CVE-2021-27391","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"APOGEE MBC (PPC) (P2 Ethernet)","version":{"version_data":[{"version_value":"All versions >= V2.6.3"}]}},{"product_name":"APOGEE MEC (PPC) (P2 Ethernet)","version":{"version_data":[{"version_value":"All versions >= V2.6.3"}]}},{"product_name":"APOGEE PXC Compact (BACnet)","version":{"version_data":[{"version_value":"All versions < V3.5.3"}]}},{"product_name":"APOGEE PXC Compact (P2 Ethernet)","version":{"version_data":[{"version_value":"All versions >= V2.8"}]}},{"product_name":"APOGEE PXC Modular (BACnet)","version":{"version_data":[{"version_value":"All versions < V3.5.3"}]}},{"product_name":"APOGEE PXC Modular (P2 Ethernet)","version":{"version_data":[{"version_value":"All versions >= V2.8"}]}},{"product_name":"TALON TC Compact (BACnet)","version":{"version_data":[{"version_value":"All versions < V3.5.3"}]}},{"product_name":"TALON TC Modular (BACnet)","version":{"version_data":[{"version_value":"All versions < V3.5.3"}]}}]},"vendor_name":"Siemens"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}]},"references":{"reference_data":[{"name":"https://cert-portal.siemens.com/productcert/pdf/ssa-944498.pdf","refsource":"MISC","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-944498.pdf"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-944498.pdf","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:48:16.974Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-23T13:27:50.374532Z","id":"CVE-2021-27391","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-23T19:28:38.162Z"}}]}}}