Siemens SIMATIC IPC Flaw Allows Secure Boot Bypass via Default Key

Key points

• CVE-2026-72895 affects multiple Siemens SIMATIC IPC models.
• A default key enables Secure Boot bypass and signed OS/UEFI boot.
• Exposure spans global critical infrastructure environments.
• Siemens advises updating affected devices to the latest versions.

A security weakness tracked as CVE-2026-72895 has been identified in Siemens SIMATIC IPC hardware. The affected lineup includes SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, SIMATIC IPC227G, SIMATIC IPC277G, SIMATIC IPC277G PRO, SIMATIC IPC327G and SIMATIC IPC377G. The flaw is tied to a cryptographic key that is shipped as a default rather than being unique per device.

Because that key is shared, an attacker can use it to get around UEFI Secure Boot protections and allow signed operating system or UEFI boot components to load. Secure Boot is meant to act as a trust anchor during startup, so a bypass weakens the assurance that only trusted code runs before the operating system takes control.

These industrial PCs are deployed in operational technology and critical infrastructure settings around the world, so the exposure is not confined to one region or sector. Even a medium-severity boot integrity issue can matter in environments where physical and logical access controls are mixed, because attackers who reach a device early in the boot chain may gain a foothold that is harder to detect later.

The immediate remediation is to update affected devices to the latest available versions from Siemens. Administrators should first inventory which SIMATIC IPC models are present, then schedule firmware updates through a controlled maintenance window. After updating, verify Secure Boot status and review boot integrity logs for unexpected changes. Watch for revised Siemens guidance, any proof-of-concept activity, and signs that exposed devices have been accessed outside normal maintenance patterns.

What to do now

1. Inventory all Siemens SIMATIC IPC BX-21A, RW-543A, 227G, 277G, 277G PRO, 327G and 377G devices in your environment.
2. Apply the latest Siemens firmware or BIOS updates to every affected model as soon as a maintenance window allows.
3. After updating, confirm that UEFI Secure Boot is enabled and that boot measurements and logs show no unexpected changes.
4. Restrict physical and network access to industrial PCs that sit in critical infrastructure or OT segments.
5. Monitor vendor advisories for CVE-2026-72895 and any revised remediation guidance from Siemens.
6. Review boot integrity and endpoint logs for anomalies that could indicate tampering before the operating system loads.

CVE references

• CVE-2026-72895

Original source

CISA Advisories