CVE-2025-40555: APOGEE PXC+TALON TC BACnet DOS Vulnerability

CVE-2025-40555 Overview

CVE-2025-40555 affects Siemens APOGEE PXC and TALON TC Series building automation controllers using BACnet. A specially crafted BACnet createObject request causes affected devices to emit unsolicited BACnet broadcast messages. The resulting broadcast storm produces a partial denial of service on the targeted controller and can degrade availability across the local BACnet network. Recovery requires a manual power cycle of the affected device.

The issue is tracked under [CWE-440: Expected Behavior Violation] and documented in the Siemens Security Advisory SSA-718393. Exploitation requires adjacent network access to the BACnet segment but no authentication or user interaction.

Critical Impact
An adjacent attacker can force affected APOGEE PXC and TALON TC controllers into a partial denial of service state that persists until the device is power cycled.

Affected Products

Siemens APOGEE PXC Series (BACnet) — all versions
Siemens TALON TC Series (BACnet) — all versions
Building automation deployments using affected controllers on shared BACnet segments

Discovery Timeline

2025-05-13 - CVE-2025-40555 published to the National Vulnerability Database
2026-06-17 - Record last updated in the NVD database

Technical Details for CVE-2025-40555

Vulnerability Analysis

The vulnerability resides in the BACnet stack of APOGEE PXC and TALON TC Series controllers. When the device processes a specific createObject request, its BACnet service handler enters a state where it continuously emits unsolicited broadcast messages. These broadcasts consume controller resources and flood the BACnet network segment.

The device does not self-recover. Normal BACnet processing on the affected controller degrades, and the traffic generated by the misbehaving device can affect other BACnet participants on the same network. Restoring service requires physically or remotely power cycling the controller, which is operationally disruptive in building automation environments where controllers regulate HVAC, lighting, and safety systems.

Although the direct impact is availability only (no confidentiality or integrity loss), building automation controllers are frequently deployed with limited monitoring, meaning the fault can persist undetected until occupants report environmental issues.

Root Cause

The root cause is an expected behavior violation ([CWE-440]) in the BACnet object creation service. The controller's handler for createObject requests does not correctly bound the resulting notification or broadcast behavior. The device treats a specific request pattern as a trigger for repeated unsolicited announcements rather than a single object creation event.

Attack Vector

Exploitation requires network adjacency to the BACnet segment hosting the affected controller. BACnet networks are typically layer-2 or routed operational technology (OT) segments isolated from corporate IT, but flat OT designs, exposed BACnet/IP gateways, and compromised engineering workstations all provide adjacency.

An attacker sends a single crafted BACnet createObject message to the target controller. No authentication is required because BACnet lacks native authentication in most deployments. The controller then begins broadcasting continuously until power cycled. See the Siemens Security Advisory SSA-718393 for protocol-level details.

Detection Methods for CVE-2025-40555

Indicators of Compromise

Sustained, high-rate unsolicited BACnet broadcast traffic (for example, I-Am, Who-Is, or object notification broadcasts) originating from a single APOGEE PXC or TALON TC controller.
Unexpected BACnet createObject requests directed at building automation controllers from unusual sources.
Loss of responsiveness or delayed BACnet responses from affected controllers preceding a required power cycle.

Detection Strategies

Baseline normal BACnet broadcast rates per controller and alert on statistically significant deviations.
Deploy OT-aware network monitoring that parses BACnet APDUs and flags anomalous createObject requests toward APOGEE PXC and TALON TC devices.
Correlate device power cycle events in the building management system (BMS) with preceding BACnet traffic spikes.

Monitoring Recommendations

Forward BACnet traffic captures and BMS event logs to a centralized analytics platform for retention and correlation.
Monitor BACnet/IP gateway logs for unauthorized clients issuing object creation requests.
Track controller uptime metrics to identify unplanned reboots consistent with recovery from this condition.

How to Mitigate CVE-2025-40555

Immediate Actions Required

Restrict BACnet network access to authorized engineering workstations and BMS servers using VLAN segmentation and ACLs.
Inventory all APOGEE PXC and TALON TC Series controllers and confirm their BACnet exposure.
Ensure remote power cycle capability is available for affected controllers to shorten recovery time if exploitation occurs.

Patch Information

At the time of publication, Siemens tracks this vulnerability as affecting all versions of APOGEE PXC and TALON TC Series (BACnet). Consult the Siemens Security Advisory SSA-718393 for the current fix status, firmware availability, and vendor-recommended remediation guidance.

Workarounds

Isolate BACnet networks from IT networks and untrusted OT zones following ISA/IEC 62443 zone-and-conduit design principles.
Block BACnet traffic at network boundaries and permit only vetted BMS and engineering hosts to reach controllers.
Deploy BACnet-aware intrusion detection to alert on createObject requests from unexpected sources.
Follow Siemens operational guidelines for securing industrial environments as referenced in SSA-718393.

bash

# Example: restrict BACnet/IP (UDP 47808) at an OT firewall to authorized BMS hosts only
# Replace addresses with your environment's engineering workstation and BMS server ranges
iptables -A FORWARD -p udp --dport 47808 -s 10.20.30.0/24 -d 10.40.50.0/24 -j ACCEPT
iptables -A FORWARD -p udp --dport 47808 -d 10.40.50.0/24 -j DROP