CVE-2026-72895
Received Received - Intake

UEFI Secure Boot Bypass in SIMATIC IPC Series

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: siemens-SADP

Description
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-72895
EUVD
EUVD-2026-98389

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Siemens SIMATIC IPC BX-21A 0
Siemens SIMATIC IPC RW-543A 0
Siemens SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1394 The product uses a default cryptographic key for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hard-coded BIOS vendor test key present in the UEFI Secure Boot key database of multiple SIMATIC IPC products. A local attacker with physical or administrative access can exploit this to boot an unsigned operating system or UEFI application signed with the test key, bypassing Secure Boot protections even when enabled. This could lead to a full compromise of the device's confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking the BIOS/UEFI Secure Boot key database for the presence of the vendor test key. Use firmware tools like 'KeyTool' from EDK II or 'sbverify' on Linux to inspect Secure Boot keys. For Siemens devices, verify the BIOS version against the advisory (V28.01.15 for IPC227G/277G/327G/377G, V31.01.13 for BX-21A, or V1.1.4 for RW-543A).

Commands may include: 'sbverify --list /path/to/bootloader' (Linux), 'KeyTool.efi' (UEFI shell), or Siemens-specific firmware utilities. Physical access or admin privileges are required to perform these checks.

Impact Analysis

If exploited, this vulnerability allows an attacker to bypass security controls on affected devices, potentially gaining full control over the system. This could result in unauthorized access to sensitive data, installation of malicious software, or disruption of device operations, leading to data breaches or operational failures.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data, resulting in data breaches. Organizations using affected devices may face legal penalties, reputational damage, and increased scrutiny for failing to maintain adequate security controls.

Mitigation Strategies

Immediately update affected Siemens SIMATIC IPC devices to the latest firmware versions (V28.01.15, V31.01.13, or V1.1.4) as per Siemens advisory. After updating, load BIOS default settings and reprovision Secure Boot keys if they were previously configured.

As a temporary measure, manually remove the test key from the Secure Boot database. Restrict physical and administrative access to devices until permanent fixes are applied. Follow Siemens operational security guidelines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72895. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart