Siemens SIMATIC IPC Firmware Vulnerability Allows UEFI Secure Boot Bypass

Siemens ProductCERT, in coordination with CISA, has issued an advisory regarding a vulnerability affecting multiple SIMATIC IPC industrial control products. The issue stems from the presence of a BIOS vendor test key within the UEFI Secure Boot key database. Tracked as CVE-2026-72895, the vulnerability has a CVSS v3.1 base score of 7.7 and is classified as HIGH severity.

The affected products and minimum required firmware versions are:
- SIMATIC IPC BX-21A: versions prior to V31.01.13
- SIMATIC IPC RW-543A: versions prior to V1.1.4
- SIMATIC IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G: versions prior to V28.01.15

An attacker with local access (physical or administrative) to an affected device could exploit this flaw to boot an operating system or UEFI application signed with the embedded test key, thereby bypassing UEFI Secure Boot protections. This could potentially lead to a full loss of confidentiality, integrity, and availability of the device and any data or processes it supports.

Siemens recommends upgrading to the latest firmware versions as the primary remediation. As a temporary mitigation, users may manually remove the test key from the UEFI Secure Boot database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A, or "insyde-ElkhartLake" for the IPC227G/277G/327G/377G and BX-21A models). However, Siemens notes that loading BIOS default settings will restore the test key, making upgrade the only definitive fix. After upgrading, users must load BIOS default settings and re-provision Secure Boot keys if they were previously provisioned.

CISA and Siemens ProductCERT have coordinated on the advisory. The vulnerability is tracked under CWE-1394 (Use of Default Cryptographic Key). No public exploitation has been confirmed at the time of the advisory release.