PEPPERL+FUCHS: HMI devices are affected by Insecure Platform Key
view advisory published 2024-11-26
A vulnerability in the use of hard-coded Platform Keys (PK) within the UEFI framework, known as PKfail, has been discovered in several Pepperl+Fuchs devices.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-8105US | — | — | ||
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitr… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- Mitigation
Protect the device from unauthorized physical access.
- Fixed
Install the appropiate updates from the Pepperl+Fuchs Homepage: * 18-34761B (BIOS 1.01) for BTC22-* * 18-35033B (BIOS 1.01) for BTC24-* * 18-34132C (BIOS 1.02) for RM-320* * 18-34132C / 18-34133E (BIOS 1.02) for PC320*
https://www.pepperl-fuchs.com/germany/de/classid_4098.htm
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan