CVE-2026-72895 Details
Description
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
A vulnerability exists in several Siemens SIMATIC IPC models, including the IPC BX-21A (all versions prior to V31.01.13), IPC RW-543A (all versions prior to V1.1.4), and the IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G (all versions prior to V28.01.15). The issue arises from a BIOS vendor test key being embedded in the UEFI Secure Boot key database. This vulnerability could enable a local attacker with physical or administrative access to the device to boot an operating system or UEFI application that is signed with the test key. This action would circumvent UEFI Secure Boot protections, even when Secure Boot is activated, potentially resulting in a complete compromise of the device's confidentiality, integrity, and availability.
Siemens has released updated versions for the affected products. Users are advised to update to the latest versions. As a temporary measure, the test key can be manually removed from the UEFI Secure Boot key database. However, restoring default settings will reinstate the test key, so updating the device is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-159454.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1394 | Use of Default Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Siemens SIMATIC IPC BX-21A | < V31.01.13 |
CPE
Remediation
| |
| Siemens SIMATIC IPC RW-543A | < V1.1.4 |
CPE
Remediation
| |
| Siemens SIMATIC IPC227G | < V28.01.15 |
CPE
Remediation
| |
| Siemens SIMATIC IPC277G | < V28.01.15 |
CPE
Remediation
| |
| Siemens SIMATIC IPC277G PRO | < V28.01.15 |
CPE
Remediation
| |
| Siemens SIMATIC IPC327G | < V28.01.15 |
CPE
Remediation
| |
| Siemens SIMATIC IPC377G | < V28.01.15 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |