● CVE — High
CVE-2019-13939
VendorsiemensProductapogee modular building controller firmware, apogee modular equiment controller firmware, apogee pxc firmware, capital vstar, desigo pxc00-e.d firmware, desigo pxc00-u firmware, desigo pxc001-e.d firmware, desigo pxc12-e.d firmware, desigo pxc22-e.d firmware, desigo pxc22.1-e.d firmware, desigo pxc36.1-e.d firmware, desigo pxc firmware, desigo pxm20 firmware, desigopxc100-e.d firmware, desigopxc128-u firmware, desigopxc200-e.d firmware, desigopxc50-e.d firmware, desigopxc64-u firmware, nucleus net, nucleus readystart, nucleus rtos, nucleus safetycert, nucleus source code, simotics connect 400 firmware, talon tc firmwareDiscoveredJan 16, 2020UpdatedJun 10, 2025
A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions = V2.8.2 = V2.8.2 = V2.3 = V2.3x and = V2.3 = V2.3 = V2.3 = V2.3x and = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3x and = V2.3 < V6.0.327), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions < V0.3.0.330), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value.