CVE-2022-45937

State: Published
Severity: 8.8 High
Published: Dec 13, 2022
Updated: Apr 21, 2025
Reserved: Nov 28, 2022

Description

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
APOGEE PXC Compact (BACnet)Siemens	All versions < V3.5.5Affected
APOGEE PXC Compact (P2 Ethernet)Siemens	All versions < V2.8.20Affected
APOGEE PXC Modular (BACnet)Siemens	All versions < V3.5.5Affected
APOGEE PXC Modular (P2 Ethernet)Siemens	All versions < V2.8.20Affected
TALON TC Compact (BACnet)Siemens	All versions < V3.5.5Affected
TALON TC Modular (BACnet)Siemens	All versions < V3.5.5Affected

References

https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.