CVE-2020-27009: high-severity vulnerability in Siemens APOGEE PXC Compact (BACnet)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in DNS name record handling allows an attacker on the network to write data beyond memory boundaries, potentially crashing the system or running malicious code. This affects building automation controllers that use the vulnerable DNS processing code.
The DNS domain name decompression logic fails to validate pointer offset values, allowing out-of-bounds writes to allocated memory structures via malformed DNS responses. An attacker positioned on the network path (man-in-the-middle capable) can trigger code execution or denial-of-service; exploitation requires crafting malicious DNS responses that bypass offset validation.
In the same product, most dangerous first.