CVE-2025-40555

A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation.

• CWE-440

• https://cert-portal.siemens.com/productcert/html/ssa-718393.html

Published

May 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40549A Path Restriction Bypass vulnerability exists in Serv-U tha…9.1
• CVE-2025-4055The Multiple Post Type Order plugin for WordPress is vulnera…6.4
• CVE-2025-40551SolarWinds Web Help Desk was found to be susceptible to an u…9.8
• CVE-2025-40552SolarWinds Web Help Desk was found to be susceptible to an a…9.8
• CVE-2025-40553SolarWinds Web Help Desk was found to be susceptible to an u…9.8
• CVE-2025-40554SolarWinds Web Help Desk was found to be susceptible to an a…9.8
• CVE-2025-40556A vulnerability has been identified in BACnet ATEC 550-440 (…7.1
• CVE-2025-4056A flaw was found in GLib. A denial of service on Windows pla…7.5
• CVE-2025-40566A vulnerability has been identified in SIMATIC PCS neo V4.1 …9.8
• CVE-2025-40567A vulnerability has been identified in RUGGEDCOM RST2428P (6…7.1
• CVE-2025-40568A vulnerability has been identified in RUGGEDCOM RST2428P (6…5.3
• CVE-2025-40569A vulnerability has been identified in RUGGEDCOM RST2428P (6…5.9