Siemens SIMATIC IPC: UEFI Secure Boot bypass via hard-coded BIOS test key

Summary

A BIOS vendor test key is stored in the UEFI Secure Boot key database of several SIMATIC IPC models. An attacker with local physical or administrative access could boot an operating system or UEFI application signed with this test key, bypassing Secure Boot even when it is enabled. This could lead to a full loss of confidentiality, integrity and availability of the device.

Affected

• SIMATIC IPC BX-21A: all versions below V31.01.13
• SIMATIC IPC RW-543A: all versions below V1.1.4
• SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G: all versions below V28.01.15

Fixed in

• SIMATIC IPC BX-21A: V31.01.13 or later
• SIMATIC IPC RW-543A: V1.1.4 or later
• SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G: V28.01.15 or later
• Fixes are BIOS updates. After the update, load the BIOS default settings and provision Secure Boot keys again if they were already in use.

Workaround

• Temporary mitigation per Siemens: manually remove the test key from the Secure Boot key database (for RW-543A e.g. "DO NOT TRUST - AMI Test PK"; for the other models e.g. "insyde-ElkhartLake").
• Loading default settings restores the test key, so the update remains recommended.
• Restrict physical access to the devices and control administrative access.

Exploitation

• Attack requires local access (physical or administrative).
• No public exploit or proof of concept known.
• No reports of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• KEV status could not be confirmed against the CISA KEV catalogue.

Our recommendation

• Identify affected SIMATIC IPC devices and check their BIOS versions.
• Schedule the BIOS update in a maintenance window, then load BIOS defaults, re-provision Secure Boot keys and verify the test key is removed.
• Until patched, apply the Siemens temporary mitigation and restrict physical and administrative access, especially on shopfloor, plant or unattended devices.
• Protect BIOS administrator passwords and follow Siemens industrial security guidelines.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Siemens SSA-159454 cert-portal.siemens.com
• CISA ICS Advisory ICSA-26-295-07 www.cisa.gov
• VulDB CVE-2026-72895 vuldb.com
• ISSSource: Siemens fixes SIMATIC IPCs www.isssource.com
• Vulners NVD:CVE-2026-72895 vulners.com
• Strix CVE-2026-72895 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:35.