CVE-2026-72895: CWE-1394: Use of Default Cryptographic Key in Siemens SIMATIC IPC BX-21A

The vulnerability identified as CVE-2026-72895 affects multiple Siemens SIMATIC IPC models by including a BIOS vendor test key in the UEFI Secure Boot key database. This test key allows an attacker with local physical or administrative access to bypass Secure Boot, enabling booting of unauthorized operating systems or UEFI applications. The affected versions are all versions prior to V31.01.13 for SIMATIC IPC BX-21A, prior to V1.1.4 for SIMATIC IPC RW-543A, and prior to V28.01.15 for SIMATIC IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G. This bypass can lead to a full loss of device confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.7, indicating high severity, with attack vector local, high attack complexity, no privileges required, user interaction required, and scope changed.

An attacker with local physical or administrative access can exploit the presence of the vendor test key to bypass UEFI Secure Boot protections. This allows booting of unauthorized operating systems or UEFI applications, potentially resulting in full compromise of the device's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the available data, users should monitor Siemens advisories for updates. Until a fix is available, restrict physical and administrative access to affected devices to mitigate exploitation risk.