Summary
The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 7.7
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions…
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-159454 advisory
-
#1
Publication Date
References
-
SSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-159454.html
-
ICS Advisory icsa-26-295-07 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b