Stack Buffer Overflow in APOGEE Building Control Systems

CVE-2026-102074 is a stack buffer overflow vulnerability (CWE-121) affecting multiple Johnson Controls APOGEE building automation controllers across BACnet and P2 Ethernet variants. With a CVSS score of 7.5, this high-severity flaw impacts critical infrastructure environments—particularly HVAC, energy management, and facility control systems deployed in commercial buildings, data centers, and industrial facilities. The vulnerability affects all versions of several controller models, with some variants requiring specific version updates (PXC and TALON TC systems prior to V3.5.7 or V2.8.21). Stack buffer overflows in building control systems are particularly concerning because they can enable remote code execution, allowing attackers to manipulate environmental controls, disrupt operations, or establish persistent access to operational technology networks.

While this CVE does not currently map to specific MITRE ATT&CK techniques in public advisories, Casky's 754 security skills—powered by Claude AI's extended reasoning—would detect attack patterns associated with buffer overflow exploitation attempts through behavioral analysis. Practitioners using Casky would identify suspicious network traffic patterns attempting to overflow input fields in controller communication protocols, anomalous memory access patterns during BACnet or P2 Ethernet sessions, and post-exploitation indicators such as unexpected process execution or lateral movement attempts within the OT network. The platform's skills would correlate these observations with techniques like Exploit Public-Facing Application (T1190) and Execution (T1059) if weaponized, providing defenders with comprehensive visibility into reconnaissance and exploitation activities targeting these vulnerable APOGEE systems.