Firmware Vulnerability in SIMATIC IPC BX-21A and Other Siemens Products

CVE-2026-72895

What is CVE-2026-72895?

A vulnerability exists in various Siemens SIMATIC IPC products due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. This may allow an unauthorized local attacker who has physical or administrative access to the device to bypass the UEFI Secure Boot mechanism, even when it is enabled. By exploiting this weakness, an attacker could potentially boot an operating system or UEFI application that is signed with the test key, leading to significant risks including loss of confidentiality, integrity, and availability of the affected devices.

References