CVE-2020-27738

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.

• CWE-788
• CWE-119

• https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdfPatch, Vendor Advisory

Published

Apr 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27731Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-27732Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-27733Zoho ManageEngine Applications Manager before 14 build 14880…8.8
• CVE-2020-27735An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary …6.1
• CVE-2020-27736A vulnerability has been identified in APOGEE PXC Compact (B…6.5
• CVE-2020-27737A vulnerability has been identified in APOGEE PXC Compact (B…6.5
• CVE-2020-27739A Weak Session Management vulnerability in Citadel WebCit th…9.8
• CVE-2020-2774Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-27740Citadel WebCit through 926 allows unauthenticated remote att…5.3
• CVE-2020-27741Multiple cross-site scripting (XSS) vulnerabilities in Citad…6.1
• CVE-2020-27742An Insecure Direct Object Reference vulnerability in Citadel…6.5
• CVE-2020-27743libtac in pam_tacplus through 1.5.1 lacks a check for a fail…9.8