A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions…

Description

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.

Scores

EPSS (exploitation in 30 days)

7.2% · top 5.7% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

• CWE-823: Use of Out-of-range Pointer Offset (opens in a new tab)All about CWE-823 and its CVEs
• CWE-787 (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• Siemens · APOGEE PXC Compact (BACnet)

  • affected All versions < V3.5.5

• Siemens · APOGEE PXC Compact (P2 Ethernet)

  • affected All versions < V2.8.20

• Siemens · APOGEE PXC Modular (BACnet)

  • affected All versions < V3.5.5

• Siemens · APOGEE PXC Modular (P2 Ethernet)

  • affected All versions < V2.8.20

• Siemens · Nucleus NET

  • affected All versions < V5.2

• Siemens · Nucleus Source Code

  • affected Versions including affected DNS modules

• Siemens · TALON TC Compact (BACnet)

  • affected All versions < V3.5.5

• Siemens · TALON TC Modular (BACnet)

  • affected All versions < V3.5.5

References (2)

• https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf (opens in a new tab)x_transferred
• https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-27009](https://trackcve.app/badge/CVE-2020-27009.svg)](https://trackcve.app/cve/CVE-2020-27009)

Record last updated 4 Aug 2024, 16:03 UTC.