Read the docs
TI-2024-37153 Aliases CVE-2024-56181GHSA-wpmj-mx2h-xgfx

Protection mechanism failure in Siemens SIMATIC Field PG M5

Priority LOW 38CWE-693Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions < V36.01.03), SIMATIC IPC RC-543B (All versions < V35.01.12), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC RW-543B (All versions < V35.02.10), SIMATIC IPC127E (All versions < V27.01.11), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions < V28.01.14), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions < V28.01.14), SIMATIC IPC277G PRO (All versions < V28.01.14), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions < V21.01.21), SIMATIC IPC477E (All versions < V21.01.21), SIMATIC IPC477E PRO (All versions < V21.01.21), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to alter the secure boot configuration without proper authorization by directly communicate with the flash controller.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed SIMATIC IPC BX-21A (Siemens): V31.01.07SIMATIC IPC BX-32A (Siemens): V29.01.07+22 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC Field PG M5all versions—No fix listedCNA
SiemensSIMATIC IPC BX-21Abefore V31.01.07V31.01.07Patch availableCNA
SiemensSIMATIC IPC BX-32Abefore V29.01.07V29.01.07Patch availableCNA
SiemensSIMATIC IPC BX-39Abefore V29.01.07V29.01.07Patch availableCNA
SiemensSIMATIC IPC BX-59Abefore V32.01.04V32.01.04Patch availableCNA
SiemensSIMATIC IPC PX-32Abefore V29.01.07V29.01.07Patch availableCNA
SiemensSIMATIC IPC PX-39Abefore V29.01.07V29.01.07Patch availableCNA
SiemensSIMATIC IPC PX-39A PRObefore V29.01.07V29.01.07Patch availableCNA
SiemensSIMATIC IPC RC-543Abefore V36.01.03V36.01.03Patch availableCNA
SiemensSIMATIC IPC RC-543Bbefore V35.01.12V35.01.12Patch availableCNA
SiemensSIMATIC IPC RW-543Abefore V1.1.4V1.1.4Patch availableCNA
SiemensSIMATIC IPC RW-543Bbefore V35.02.10V35.02.10Patch availableCNA
SiemensSIMATIC IPC127Ebefore V27.01.11V27.01.11Patch availableCNA
SiemensSIMATIC IPC227Eall versions—No fix listedCNA
SiemensSIMATIC IPC227Gbefore V28.01.14V28.01.14Patch availableCNA
SiemensSIMATIC IPC277Eall versions—No fix listedCNA
SiemensSIMATIC IPC277Gbefore V28.01.14V28.01.14Patch availableCNA
SiemensSIMATIC IPC277G PRObefore V28.01.14V28.01.14Patch availableCNA
SiemensSIMATIC IPC3000 SMART V3all versions—No fix listedCNA
SiemensSIMATIC IPC327Gbefore V28.01.14V28.01.14Patch availableCNA
SiemensSIMATIC IPC347Gall versions—No fix listedCNA
SiemensSIMATIC IPC377Gbefore V28.01.14V28.01.14Patch availableCNA
SiemensSIMATIC IPC427Ebefore V21.01.21V21.01.21Patch availableCNA
SiemensSIMATIC IPC477Ebefore V21.01.21V21.01.21Patch availableCNA
SiemensSIMATIC IPC477E PRObefore V21.01.21V21.01.21Patch availableCNA
SiemensSIMATIC IPC527Gall versions—No fix listedCNA
SiemensSIMATIC IPC627Ebefore V25.02.15V25.02.15Patch availableCNA
SiemensSIMATIC IPC647Ebefore V25.02.15V25.02.15Patch availableCNA
SiemensSIMATIC IPC677Ebefore V25.02.15V25.02.15Patch availableCNA
SiemensSIMATIC IPC847Ebefore V25.02.15V25.02.15Patch availableCNA
SiemensSIMATIC ITP1000all versions—No fix listedCNA
  • SIMATIC Field PG M5 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC IPC BX-21A VendorSiemens Affected before V31.01.07 Fixed in V31.01.07 Patch available CNA
  • SIMATIC IPC BX-32A VendorSiemens Affected before V29.01.07 Fixed in V29.01.07 Patch available CNA
  • SIMATIC IPC BX-39A VendorSiemens Affected before V29.01.07 Fixed in V29.01.07 Patch available CNA
  • SIMATIC IPC BX-59A VendorSiemens Affected before V32.01.04 Fixed in V32.01.04 Patch available CNA
  • SIMATIC IPC PX-32A VendorSiemens Affected before V29.01.07 Fixed in V29.01.07 Patch available CNA
  • SIMATIC IPC PX-39A VendorSiemens Affected before V29.01.07 Fixed in V29.01.07 Patch available CNA
  • SIMATIC IPC PX-39A PRO VendorSiemens Affected before V29.01.07 Fixed in V29.01.07 Patch available CNA
  • SIMATIC IPC RC-543A VendorSiemens Affected before V36.01.03 Fixed in V36.01.03 Patch available CNA
  • SIMATIC IPC RC-543B VendorSiemens Affected before V35.01.12 Fixed in V35.01.12 Patch available CNA
  • SIMATIC IPC RW-543A VendorSiemens Affected before V1.1.4 Fixed in V1.1.4 Patch available CNA
  • SIMATIC IPC RW-543B VendorSiemens Affected before V35.02.10 Fixed in V35.02.10 Patch available CNA
  • SIMATIC IPC127E VendorSiemens Affected before V27.01.11 Fixed in V27.01.11 Patch available CNA
  • SIMATIC IPC227E VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC IPC227G VendorSiemens Affected before V28.01.14 Fixed in V28.01.14 Patch available CNA
  • SIMATIC IPC277E VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC IPC277G VendorSiemens Affected before V28.01.14 Fixed in V28.01.14 Patch available CNA
  • SIMATIC IPC277G PRO VendorSiemens Affected before V28.01.14 Fixed in V28.01.14 Patch available CNA
  • SIMATIC IPC3000 SMART V3 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC IPC327G VendorSiemens Affected before V28.01.14 Fixed in V28.01.14 Patch available CNA
  • SIMATIC IPC347G VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC IPC377G VendorSiemens Affected before V28.01.14 Fixed in V28.01.14 Patch available CNA
  • SIMATIC IPC427E VendorSiemens Affected before V21.01.21 Fixed in V21.01.21 Patch available CNA
  • SIMATIC IPC477E VendorSiemens Affected before V21.01.21 Fixed in V21.01.21 Patch available CNA
  • SIMATIC IPC477E PRO VendorSiemens Affected before V21.01.21 Fixed in V21.01.21 Patch available CNA
  • SIMATIC IPC527G VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC IPC627E VendorSiemens Affected before V25.02.15 Fixed in V25.02.15 Patch available CNA
  • SIMATIC IPC647E VendorSiemens Affected before V25.02.15 Fixed in V25.02.15 Patch available CNA
  • SIMATIC IPC677E VendorSiemens Affected before V25.02.15 Fixed in V25.02.15 Patch available CNA
  • SIMATIC IPC847E VendorSiemens Affected before V25.02.15 Fixed in V25.02.15 Patch available CNA
  • SIMATIC ITP1000 VendorSiemens Affected all versions Fixed in — No fix listed CNA

Remediation

  • Fix · CNA SIMATIC IPC BX-21A (Siemens) Fixed in V31.01.07
  • Fix · CNA SIMATIC IPC BX-32A (Siemens) Fixed in V29.01.07
  • Fix · CNA SIMATIC IPC BX-39A (Siemens) Fixed in V29.01.07
  • Fix · CNA SIMATIC IPC BX-59A (Siemens) Fixed in V32.01.04
  • Fix · CNA SIMATIC IPC PX-32A (Siemens) Fixed in V29.01.07
  • Fix · CNA SIMATIC IPC PX-39A (Siemens) Fixed in V29.01.07
  • Fix · CNA SIMATIC IPC PX-39A PRO (Siemens) Fixed in V29.01.07
  • Fix · CNA SIMATIC IPC RC-543A (Siemens) Fixed in V36.01.03
  • Fix · CNA SIMATIC IPC RC-543B (Siemens) Fixed in V35.01.12
  • Fix · CNA SIMATIC IPC RW-543A (Siemens) Fixed in V1.1.4
  • Fix · CNA SIMATIC IPC RW-543B (Siemens) Fixed in V35.02.10
  • Fix · CNA SIMATIC IPC127E (Siemens) Fixed in V27.01.11
  • Fix · CNA SIMATIC IPC227G (Siemens) Fixed in V28.01.14
  • Fix · CNA SIMATIC IPC277G (Siemens) Fixed in V28.01.14
  • Fix · CNA SIMATIC IPC277G PRO (Siemens) Fixed in V28.01.14
  • Fix · CNA SIMATIC IPC327G (Siemens) Fixed in V28.01.14
  • Fix · CNA SIMATIC IPC377G (Siemens) Fixed in V28.01.14
  • Fix · CNA SIMATIC IPC427E (Siemens) Fixed in V21.01.21
  • Fix · CNA SIMATIC IPC477E (Siemens) Fixed in V21.01.21
  • Fix · CNA SIMATIC IPC477E PRO (Siemens) Fixed in V21.01.21
  • Fix · CNA SIMATIC IPC627E (Siemens) Fixed in V25.02.15
  • Fix · CNA SIMATIC IPC647E (Siemens) Fixed in V25.02.15
  • Fix · CNA SIMATIC IPC677E (Siemens) Fixed in V25.02.15
  • Fix · CNA SIMATIC IPC847E (Siemens) Fixed in V25.02.15

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SIMATIC IPC BX-21A, SIMATIC IPC BX-32A and 22 more products V1.1.4, V21.01.21 and 9 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-37154 Protection mechanism failure in Siemens SIMATIC Field PG M5Priority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-56181
  2. 2026-10-03 Alias added: GHSA-wpmj-mx2h-xgfx

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences