CVE:CVE-2021-27391
CNNVD:CNNVD-202109-940
Siemens APOGEE MBC是德国西门子（Siemens）公司的一个模块化楼宇控制器。
Siemens APOGEE MBC 存在缓冲区错误漏洞，该漏洞源于产品在解析请求时缺乏适当的边界检查。攻击者可通过该漏洞在执行具备root权限的命令。以下产品及版本受到影响: Siemens APOGEE MBC (PPC) (P2以太网) V2.6.3 版本、APOGEE MEC (PPC) (P2以太网) V2.6.3版本、 APOGEE PXC Compact (BACnet) V3.5.3 之前版本， APOGEE PXC Compact (P2以太网) V2.8版本， APOGEE PXC Modular (BACnet) V3.5.3 之前版本、APOGEE PXC模块化(P2以太网) V2.8 版本、 TALON TC Compact (BACnet) V3.5.3 之前版本、 TALON TC模块化(BACnet) V3.5.3 之前版本。
solution:Upgrade siemens apogee_mbc_(ppc)_(p2_ethernet)_firmware to a higher version than 2.6.3,and avoid the version (,2.6.3]; Upgrade siemens apogee_mec_(ppc)_(p2_ethernet)_firmware to a higher version than 2.6.3,and avoid the version (,2.6.3]; Upgrade siemens apogee_pxc_bacnet_automation_controller_firmware to a higher version than 3.5.3,and avoid the version (,3.5.3); Upgrade siemens apogee_pxc_compact_(p2_ethernet)_firmware to a higher version than 2.8,and avoid the version (,2.8]; Upgrade siemens apogee_pxc_modular_(bacnet)_firmware to a higher version than 3.5.3,and avoid the version (,3.5.3); Upgrade siemens apogee_pxc_modular_(p2_ethernet)_firmware to a higher version than 2.8,and avoid the version (,2.8]; Upgrade siemens talon_tc_compact_(bacnet)_firmware to a higher version than 3.5.3,and avoid the version (,3.5.3); Upgrade siemens talon_tc_modular_(bacnet)_firmware to a higher version than 3.5.3,and avoid the version (,3.5.3)