Get real-time updates on Telegram
CVE-2026-72895: SIMATIC IPC BX-21A 0 to before V31.01.13; +2 more affected products
CVE-2026-72895. CVSS 3.1 base score 7.7 (GitHub Advisory Database).
Affected technology
SIMATIC IPC BX-21A · 0 to before V31.01.13
Siemens
SIMATIC IPC RW-543A · 0 to before V1.1.4
Siemens
SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G · 0 to before V28.01.15
Siemens
Description’s affected range: versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15)
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Active user interaction
What an attacker can do
A local attacker with physical or administrative access to the device could boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device. Vendor/CNA’s CVSS 4.0 assessment (base score 8.4/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-1394
- CCR priority
- 30.8 /100 (P4)
- CVSS 3.1
- 7.7 /10 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H · GitHub Advisory Database
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-13 13:59:32.738573+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-13 13:56:14.349801+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-72895.html