TI-2026-71579 Aliases CVE-2026-72895 GHSA-f9v9-v28p-r5mp

Test key in UEFI Secure Boot database in Siemens SIMATIC IPC devices

LOW 37CWE-1394Published 2026-10-13 · Updated 2026-10-14

Key facts

Attack vector: Local
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Siemens SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, and SIMATIC IPC227G, IPC277G, IPC277G PRO, IPC327G and IPC377G are affected in versions before V31.01.13, V1.1.4 and V28.01.15 respectively. The UEFI Secure Boot key database contains a BIOS vendor test key, which is a use of default cryptographic key (CWE-1394). A local attacker with physical or administrative access can boot an operating system or UEFI application signed with that test key, bypassing Secure Boot even when it is enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00107 1st percentileScored 2026-11-07

Fix Fixed SIMATIC IPC BX-21A (Siemens): V31.01.13SIMATIC IPC RW-543A (Siemens): V1.1.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	SIMATIC IPC BX-21A	before V31.01.13	V31.01.13	Patch available	CNA
Siemens	SIMATIC IPC RW-543A	before V1.1.4	V1.1.4	Patch available	CNA
Siemens	SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G	before V28.01.15	V28.01.15	Patch available	CNA

SIMATIC IPC BX-21A VendorSiemens Affected before V31.01.13 Fixed in V31.01.13 Patch available CNA
SIMATIC IPC RW-543A VendorSiemens Affected before V1.1.4 Fixed in V1.1.4 Patch available CNA
SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G VendorSiemens Affected before V28.01.15 Fixed in V28.01.15 Patch available CNA

Remediation

Siemens lists fixed versions V31.01.13 for SIMATIC IPC BX-21A, V1.1.4 for SIMATIC IPC RW-543A, and V28.01.15 for SIMATIC IPC227G, IPC277G, IPC277G PRO, IPC327G and IPC377G.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Fix · CNA SIMATIC IPC BX-21A (Siemens) Fixed in V31.01.13
Fix · CNA SIMATIC IPC RW-543A (Siemens) Fixed in V1.1.4
Fix · CNA SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (Siemens) Fixed in V28.01.15

Timeline

2026-10-13 Threatist record created from CVE-2026-72895
2026-10-13 Alias added: GHSA-f9v9-v28p-r5mp
2026-10-14 Priority changed: MEDIUM → LOW
2026-10-15 CISA SSVC decision points changed

References

Other 1

https://cert-portal.siemens.com/productcert/html/ssa-159454.html

TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0

See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences