Medium severity · published Dec 13, 2022
CVE-2022-45937
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet)…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
APOGEE PXC Compact (BACnet) · Siemens
All versions < V3.5.5 · source: vendor
AP
APOGEE PXC Compact (P2 Ethernet) · Siemens
All versions < V2.8.20 · source: vendor
AP
APOGEE PXC Modular (BACnet) · Siemens
All versions < V3.5.5 · source: vendor
AP
APOGEE PXC Modular (P2 Ethernet) · Siemens
All versions < V2.8.20 · source: vendor
TT
TALON TC Compact (BACnet) · Siemens
All versions < V3.5.5 · source: vendor
TT
TALON TC Modular (BACnet) · Siemens
All versions < V3.5.5 · source: vendor
PF
Pxc00-e96.a Firmware · Siemens
before 3.5.5 · source: NVD
PF
Pxc100-e96.a Firmware · Siemens
before 3.5.5 · source: NVD
PF
Pxc16.2-pe.a Firmware · Siemens
before 2.8.20 · source: NVD
PF
Pxc24.2-pe.a Firmware · Siemens
before 2.8.20 · source: NVD
PF
Pxc24.2-pef.a Firmware · Siemens
before 2.8.20 · source: NVD
PF
Pxc24.2-per.a Firmware · Siemens
before 2.8.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45937
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45937
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
More from APOGEE PXC Compact (BACnet)
8.2
CVE-2026-102073
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE…
7.5
CVE-2026-102076
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE…
7.5
CVE-2026-102075
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE…
7.5
CVE-2026-102074
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE…
7.5
CVE-2022-38371
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE…