CVE-2024-8105

highpriority · track · 0EPSS 0.003 · 20 %ileDEEUJPRU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.27% (20th) EPSS

CVSS 8.2 · high

Is it mine?

798 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · pepperl_fuchs_psirt

EPSS · scored 2026-10-27

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpepperl_fuchs_psirt
Install the appropiate updates from the Pepperl+Fuchs Homepage: * 18-34761B (BIOS 1.01) for BTC22-* * 18-35033B (BIOS 1.01) for BTC24-* * 18-34132C (BIOS 1.02) for RM-320* * 18-34132C / 18-34133E (BIOS 1.02) for PC320*
https://www.pepperl-fuchs.com/germany/de/classid_4098.htm
Mitigationpepperl_fuchs_psirt
Protect the device from unauthorized physical access.

cvss

Technical severity, 0–10. One row per scoring source.

8.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.2

v3.18.2highAV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.4mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.16.4mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 0.5 · impact 5.9

v3.16.4mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · Pepperl+Fuchs PSIRT DE

v3.15.9mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1394USCWE-1394US

affected products (798)

Products and version ranges known to be affected.

AU47 M1≤ d3715136d50f…enisa_euvdEU
B760M D2HX LITE SI (rev. 1.0)≤ 641b9c056a8f…enisa_euvdEU
C621 AORUS XTREME (rev. 1.0)≤ 7edc3eecb5d5…enisa_euvdEU
C621-SD8≤ d6ad23c1fab3…enisa_euvdEU
C621-SU8 (rev. 1.0)≤ b9017e90f6c4…enisa_euvdEU
C621-WD12≤ f528dbe55aba…enisa_euvdEU
C621-WD12-IPMI (rev. 1.0)≤ 0215ce75b362…enisa_euvdEU
D120-C20 (rev. 230)≤ cef953fd8883…enisa_euvdEU
E133-C10≤ 2d5900b5a132…enisa_euvdEU
E133-C10 (rev. AAA1)≤ 2af044c4474a…enisa_euvdEU
E152-ZE0≤ 83d24271a7b1…enisa_euvdEU
E152-ZE1 (rev. A00)≤ a9638651a247…enisa_euvdEU
E162-220≤ 0c8eb9d218ca…enisa_euvdEU
E163-S30 (rev. AAB1)≤ a7ac0837b77d…enisa_euvdEU
E163-Z30≤ 1ecbdd2c9fdb…enisa_euvdEU
E251-U70 (rev. 100)≤ 6c404dfcb955…enisa_euvdEU
E283-S90 (rev. AAD1)≤ 059d906408ac…enisa_euvdEU
E283-Z90≤ 40d4956a4275…enisa_euvdEU
E283-Z91 (rev. AAV1)≤ 1fee66203063…enisa_euvdEU
EL-20-3060-32G (rev. 1.0)≤ 8e0251d45183…enisa_euvdEU

showing 20 of 798

advisories (2)

Vendor and ecosystem advisories describing this.

VDE-2024-065PEPPERL+FUCHS: HMI devices are affected by Insecure Platform Key 2024-11-26csaf · pepperl_fuchs_psirtDE
A vulnerability in the use of hard-coded Platform Keys (PK) within the UEFI framework, known as PKfail, has been discovered in several Pepperl+Fuchs devices.
JVNDB-2024-000090JVN iPedia advisory JVNDB-2024-0000902024-09-06vendor · jvndbJP

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu pepperl_fuchs_psirt jvndb NVD CVE.org MITRE

published 2024-08-26modified 2026-06-28

references (27)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan