Siemens SIMATIC IPCs allow UEFI Secure Boot bypass (CVE-2026-72895)
Physical access attackers can boot arbitrary OS signed with AMI test key; fixes released for BX-21A, RW-543A, and IPC227G series.
60
CVE-2026-72895
UEFI Secure Boot test-key bypass in Siemens SIMATIC IPC
- CVSS 4.0
- 8.4 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Several Siemens SIMATIC industrial PCs ship with a BIOS vendor test key enrolled in the UEFI Secure Boot key database. A local attacker who already has physical or administrative access can boot an operating system or UEFI application signed with that test key even while Secure Boot is enabled, bypassing the intended boot integrity check. Successful abuse can lead to a full loss of confidentiality, integrity, and availability of the device. Affected products are SIMATIC IPC BX-21A before V31.01.13, SIMATIC IPC RW-543A before V1.1.4, and SIMATIC IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G before V28.01.15. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Install the fixed firmware on each model: SIMATIC IPC BX-21A V31.01.13 or later, SIMATIC IPC RW-543A V1.1.4 or later, and SIMATIC IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G V28.01.15 or later. Until then, restrict physical and administrative access to the devices and treat any unexpected boot or Secure Boot key change as a security incident.
| Product | Affected |
|---|---|
| Siemens SIMATIC IPC BX-21A | All versions < V31.01.13 |
| Siemens SIMATIC IPC RW-543A | All versions < V1.1.4 |
| Siemens SIMATIC IPC227G | All versions < V28.01.15 |
| Siemens SIMATIC IPC277G | All versions < V28.01.15 |
| Siemens SIMATIC IPC277G PRO | All versions < V28.01.15 |
| Siemens SIMATIC IPC327G | All versions < V28.01.15 |
| Siemens SIMATIC IPC377G | All versions < V28.01.15 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
- Weakness
- CWE-1394
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X