Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Siemens issues BIOS fixes for SIMATIC IPC Secure Boot bypass

1 source · 3 articlesFirst reported Updated ()1
What's new

October 22: CISA’s SIMATIC IPC advisory restates the known BIOS fixes and post-upgrade Secure Boot steps, with no new versions or exploitation claims.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Siemens has released BIOS updates so affected SIMATIC IPCs reject AMI test-key signatures when Secure Boot is enabled.

Siemens SIMATIC industrial PCs let a local attacker with physical or administrative access boot an operating system or UEFI application signed with an AMI test key, bypassing UEFI Secure Boot even when it is enabled. The issue, CVE-2026-72895, affects SIMATIC IPC BX-21A before BIOS 31.01.13, RW-543A before 1.1.4, and IPC227G, 277G, PRO, 327G, and 377G before 28.01.15. Siemens has released fixed BIOS versions. CISA recommends isolating control-system networks and applying general defensive practices. After an upgrade, operators should load default settings, reprovision Secure Boot keys, and may temporarily remove the test key from the database.

Key facts
  • CVE-2026-72895 lets AMI test-key signatures boot despite Secure Boot.
  • BX-21A fixed in BIOS 31.01.13; RW-543A fixed in 1.1.4.
  • IPC227G, 277G, PRO, 327G, and 377G fixed in BIOS 28.01.15.
  • Attacker needs physical or administrative access; no remote exploitation stated.
  • After upgrade, load defaults and reprovision Secure Boot keys.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026CISA publishes SIMATIC IPC Secure Boot advisory · CISA Advisories

What each outlet adds

beyond the shared facts
  • CISA AdvisoriesLists fixed BIOS versions and post-upgrade Secure Boot steps.
CVEs
CVE-2026-72895CVE-2026-85114CVE-2026-85115CVE-2021-41617
Vendors
Siemens
Products
SIMATIC IPC BX-21ASIMATIC IPC RW-543ASIMATIC IPC227GIPC277GIPC277G PROIPC327GIPC377GNET Client Library for SIMATIC S7 Webserver APISIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPSIPLUS S7-1500 CPU 1518-4 PN/DP MFPOpenSSH
Organizations
CISASiemens ProductCERT

Coverage

oldest first · one row per article · UTC
  1. · 8d ago CISA AdvisoriesFirst report

    Siemens SIMATIC S7 Webserver API vulnerabilities

    NET Client Library for SIMATIC S7 Webserver API versions before 3.3.61 and 3.3.62 vulnerable to path traversal and sensitive information exposure; update to 3.3.61 or later.

  2. · 8d ago CISA Advisories

    Siemens SIMATIC IPCs allow UEFI Secure Boot bypass (CVE-2026-72895)

    Physical access attackers can boot arbitrary OS signed with AMI test key; fixes released for BX-21A, RW-543A, and IPC227G series.

  3. · 8d ago CISA Advisories

    S7-1500 CPU 1518 MFP Linux subsystem flaws lack a fix

    Firmware V3.1.7 and later on five 1518 and SIPLUS MFP CPUs is affected, including OpenSSH CVE-2021-41617.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2021-41617
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not…
7.03%
CVE-2026-72895
UEFI Secure Boot test-key bypass in Siemens SIMATIC IPC
8.4—
CVE-2026-85114
Path traversal in Siemens .NET SIMATIC S7 Webserver client
8.7—
CVE-2026-85115
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62)
6.8—