Vulnerability: Bypass of UEFI Secure Boot in Siemens SIMATIC IPCs (CVE‑2026‑72895) Enables Local Privilege Escalation
What It Is – A firmware‑level flaw (CVE‑2026‑72895) leaves a Siemens test key in the UEFI Secure Boot key database. An attacker with physical or administrative access can sign a malicious OS or UEFI payload with that test key and boot it, effectively bypassing Secure Boot protections.
Exploitability – The vulnerability is high‑severity (CVSS v3 7.7). Exploits require local access; no public exploit code is known, but the attack path is straightforward once the device is compromised.
Affected Products – Siemens SIMATIC IPC BX‑21A (versions < 31.01.13), IPC RW‑543A (versions < 1.1.4), IPC 227G / 277G / 277G PRO / 327G / 377G (versions < 28.01.15).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous firmware‑integrity monitoring to prove that only authorized keys are present in the Secure Boot database.
- Highlights a control‑mapping gap: without evidence that Secure Boot configurations are regularly validated, auditors cannot confirm the “secure configuration” objective across frameworks.
- Enterprise buyers increasingly demand defensible audit evidence that hardware platforms enforce cryptographic controls, not just a statement of compliance.
Recommended Actions
- Deploy Siemens’ latest firmware for all listed IPC models immediately.
- Verify the UEFI key database post‑update to ensure the test key is removed.
- Integrate firmware‑integrity checks into your continuous monitoring platform and retain logs as audit evidence.
- Document the remediation in your control‑mapping repository to demonstrate coverage of the “secure configuration & firmware integrity” control objective.
Source: CISA Advisory – ICSA‑26‑295‑07