SSA-159454

csafDEsiemens_psirt

SSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs

Advisory ansehen veröffentlicht 2026-10-13

The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2026-72895DEhigh7.7—
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (6)

  • MitigationSIMATIC IPC BX-21A

    <br/>Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.

  • MitigationSIMATIC IPC RW-543A

    <br/>Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.

  • MitigationSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G

    <br/>Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.

  • BehobenSIMATIC IPC BX-21A

    Update to V31.01.13 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763408/
  • BehobenSIMATIC IPC RW-543A

    Update to V1.1.4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763408/
  • BehobenSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G

    Update to V28.01.15 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763408/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan