Siemens SIMATIC IPCs Vulnerable to UEFI Secure Boot Bypass
A critical vulnerability in Siemens SIMATIC Industrial PCs allows attackers to bypass UEFI Secure Boot using a default test key, potentially leading to full system compromise.
Siemens SIMATIC Industrial Personal Computers (IPCs) are affected by a critical vulnerability, identified as CVE-2026-72895, that undermines the integrity of the UEFI Secure Boot process. This flaw stems from the presence of a default cryptographic test key within the device's UEFI Secure Boot key database. Attackers with local or physical access can leverage this test key to boot an operating system or UEFI application that is signed with it, effectively bypassing Secure Boot protections even when the feature is enabled.
The implications of this bypass are severe, potentially granting an attacker full control over the affected Siemens SIMATIC IPC models. This could lead to a complete loss of confidentiality, integrity, and availability of the device, which are often critical components in industrial control systems (ICS) environments. The vulnerability impacts several specific Siemens SIMATIC IPC product lines, including the BX-21A, RW-543A, and various models within the IPC227G, IPC277G, IPC327G, and IPC377G series, affecting specific versions prior to the vendor's released patches.
Siemens has acknowledged the vulnerability and has released updated versions for the affected IPC models to address the issue. The company strongly recommends that users update their systems to the latest available versions. However, the remediation process involves more than just a software update. After upgrading to the fixed BIOS version, users are instructed to load the BIOS default settings. Crucially, if Secure Boot keys were previously provisioned on the device, they must be re-provisioned after loading the defaults to ensure the security mechanism functions correctly with the updated configuration.
As a temporary mitigation measure before applying the full vendor fix, users can manually remove the specific test key from the UEFI Secure Boot database. For instance, the "DO NOT TRUST - AMI Test PK" key can be removed for the RW-543A, and the "insyde-ElkhartLake" key for the IPC227G/277G/327G/377G and BX-21A models. It is important to note that loading default BIOS settings will restore the test key, underscoring the necessity of the vendor update as the permanent solution.
The vulnerability is categorized under CWE-1394, "Use of Default Cryptographic Key," and has been assigned a CVSS v3.1 base score of 7.7, classifying it as HIGH severity. The attack vector is local (AV:L), requiring a high level of complexity (AC:H) with no privileges (PR:N) and user interaction (UI:R) to exploit. The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), with a scope change (S:C) indicating that the vulnerability can affect components beyond the vulnerable application.
This advisory highlights a persistent challenge in securing industrial control systems: the reliance on default configurations and test keys that can be exploited by attackers. While Secure Boot is designed to ensure that only trusted software is loaded during the boot process, the presence of a default test key creates a backdoor that can be used to circumvent these protections. The wide deployment of affected Siemens SIMATIC IPCs across critical infrastructure sectors such as Critical Manufacturing, Transportation Systems, Energy, and Healthcare, underscores the potential impact of this vulnerability.
CISA, in conjunction with Siemens, is urging organizations to implement defensive measures. These include minimizing network exposure of control system devices, isolating them behind firewalls, and using secure remote access methods like VPNs. Organizations are advised to perform thorough impact analyses and risk assessments before deploying any defensive strategies. The detailed recommendations provided by CISA and Siemens aim to guide users through the patching process and reinforce overall ICS security best practices.