CVE-2026-72895
HighCVSS 7.7Summary
A vulnerability in SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, and SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G is due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. A local attacker with physical or administrative access can boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
Risk Assessment
The risk includes the possibility of booting unauthorized software, potentially leading to full device and data compromise.
Recommendation
Update to the specified versions or later and remove the test key from the Secure Boot key database.
Other vulnerabilities in SIMATIC IPC
See all- CVE-2024-56182High
A vulnerability in SIMATIC IPC devices allows an authenticated attacker to bypass EFI variable protection and disable the BIOS password without authorization by directly communicating with the flash controller.
- CVE-2024-56181High
A vulnerability in SIMATIC IPC devices allows an authenticated attacker to modify EFI variables without authorization by directly communicating with the flash controller. The issue stems from insufficient protection of EFI variables, potentially enabling changes to Secure Boot configuration.
Original NVD description (English source)
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS