CVE-2024-54089 Overview
CVE-2024-54089 affects Siemens APOGEE PXC Series (BACnet), APOGEE PXC Series (P2 Ethernet), and TALON TC Series (BACnet) building automation controllers. The vulnerability stems from a weak encryption mechanism that relies on a hard-coded key [CWE-326]. An attacker can guess or decrypt password ciphertext obtained from an affected device. All firmware versions of the listed product families are impacted. The flaw carries a CVSS v4.0 base score of 8.7 and is network exploitable without authentication or user interaction. No public exploit code or in-the-wild exploitation has been reported at the time of publication.
Critical Impact
Attackers with access to encrypted password material can recover plaintext credentials for building automation controllers, enabling unauthorized control of HVAC, lighting, and life-safety systems.
Affected Products
- APOGEE PXC Series (BACnet) — all versions
- APOGEE PXC Series (P2 Ethernet) — all versions
- TALON TC Series (BACnet) — all versions
Discovery Timeline
- 2025-02-11 - CVE-2024-54089 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54089
Vulnerability Analysis
The vulnerability is a cryptographic weakness classified under [CWE-326] Inadequate Encryption Strength. The affected controllers use an encryption routine keyed with a static, hard-coded value embedded in firmware. Because the key is identical across devices in the product family, any adversary who obtains the key material or reverses the firmware can decrypt password ciphertext produced by any deployed controller.
APOGEE PXC and TALON TC devices are field-level building automation controllers commonly deployed in commercial real estate, hospitals, and industrial facilities. They authenticate operators for configuration changes, and the resulting password ciphertext traverses BACnet or P2 Ethernet networks. Recovery of plaintext credentials grants full administrative control of the controller and any downstream field devices.
Root Cause
The root cause is the use of a hard-coded cryptographic key within the firmware to protect password material. Hard-coded keys violate secure key management principles because they cannot be rotated, are shared across the installed base, and are recoverable through firmware extraction or static analysis.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker positioned on the operational technology network — either directly or through a compromised IT-OT boundary — can capture password ciphertext during authentication exchanges or read it from device configuration exports. Using the hard-coded key, the attacker decrypts the ciphertext and reuses the recovered credentials for administrative access.
No verified proof-of-concept code has been published. Refer to the Siemens Security Advisory SSA-615116 for vendor-provided technical detail.
Detection Methods for CVE-2024-54089
Indicators of Compromise
- Unexpected administrative logins to APOGEE PXC or TALON TC controllers from workstations that do not normally manage building automation systems.
- Unauthorized configuration changes, point overrides, or schedule modifications on affected controllers.
- BACnet or P2 Ethernet traffic originating from IP addresses outside the documented engineering workstation range.
Detection Strategies
- Monitor BACnet/IP (UDP 47808) and P2 Ethernet traffic for authentication attempts from unauthorized hosts.
- Baseline normal engineering workstation behavior and alert on deviations, including off-hours access to controllers.
- Inspect controller audit logs for repeated authentication events preceding configuration changes.
Monitoring Recommendations
- Forward controller syslog and BACnet event notifications to a centralized SIEM for correlation with network flow data.
- Deploy passive OT network monitoring at aggregation switches to inventory devices and flag new or spoofed BACnet endpoints.
- Review firewall logs at the IT-OT boundary for lateral movement toward building automation subnets.
How to Mitigate CVE-2024-54089
Immediate Actions Required
- Isolate APOGEE PXC and TALON TC controllers on a dedicated VLAN with strict access control lists limiting management traffic to authorized engineering workstations.
- Rotate all controller passwords and disable any shared or default operator accounts.
- Restrict physical access to controllers and cabling to prevent local packet capture.
Patch Information
Siemens has not published a firmware fix for the affected APOGEE PXC and TALON TC product families in the referenced advisory. Consult the Siemens Security Advisory SSA-615116 for the current remediation status and any subsequent updates.
Workarounds
- Follow Siemens operational guidelines for industrial security and the recommendations in IEC 62443 for network segmentation.
- Place affected controllers behind a firewall that permits BACnet and management protocols only from explicitly authorized engineering stations.
- Use a VPN or jump host with multi-factor authentication for any remote access to the building automation network.
- Monitor for and disable unused network services on the controllers to reduce exposure.
# Example: restrict BACnet/IP access to controllers using iptables on an upstream gateway
iptables -A FORWARD -p udp --dport 47808 -s 10.10.20.0/24 -d 10.20.30.0/24 -j ACCEPT
iptables -A FORWARD -p udp --dport 47808 -d 10.20.30.0/24 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
