A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-102073 is an integer underflow vulnerability (CWE-191) affecting multiple Johnson Controls building automation and HVAC control systems across BACnet and P2 Ethernet communication protocols. This vulnerability impacts APOGEE and TALON controller families used in critical building infrastructure, with CVSS 8.2 indicating high severity. Integer underflow occurs when a numeric value decreases below its minimum representable value, causing unexpected behavior, memory corruption, or system crashes. Organizations managing commercial buildings, data centers, and industrial facilities relying on these controllers face potential disruption to environmental controls, facility operations, and potentially safety systems. The broad version impact across multiple product lines and communication standards suggests widespread exposure in deployed infrastructure.
While this CVE currently shows no mapped MITRE ATT&CK techniques and zero matching Casky skills, practitioners should monitor for exploitation patterns associated with firmware manipulation and industrial control system compromise. Casky's Claude-powered analysis would detect attack chains involving device communication anomalies, unexpected state transitions in building automation logic, and malformed protocol messages attempting to trigger integer underflow conditions. Security teams should focus detection efforts on BACnet and P2 Ethernet traffic analysis, monitoring for crafted packets designed to cause numeric boundary violations in controller firmware. Immediate actions include prioritizing firmware updates for affected APOGEE PXC and TALON TC systems to patched versions (V3.5.7 for BACnet, V2.8.21 for P2 Ethernet variants) and implementing network segmentation to isolate building automation systems from untrusted network access.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-102073. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation