CVE-2022-45937: Siemens PXC00-e96.a Firmware

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.

Affected products

• Siemens PXC00-e96.a Firmware: before 3.5.5 (fixed in 3.5.5)
• Siemens PXC100-e96.a Firmware: before 3.5.5 (fixed in 3.5.5)
• Siemens PXC16.2-Pe.a Firmware: before 2.8.20 (fixed in 2.8.20)
• Siemens PXC24.2-Pe.a Firmware: before 2.8.20 (fixed in 2.8.20)
• Siemens PXC24.2-Pef.a Firmware: before 2.8.20 (fixed in 2.8.20)
• Siemens PXC24.2-Per.a Firmware: before 2.8.20 (fixed in 2.8.20)
• Siemens PXC24.2-Perf.a Firmware: before 2.8.20 (fixed in 2.8.20)
• Siemens Pxx-485.3 Firmware: before 3.5.5 (fixed in 3.5.5)
• Siemens Talon Tc Modular (bacnet) Firmware: before 3.5.5 (fixed in 3.5.5)

Published 2022-12-13. Last modified 2026-06-17.