Skip to content
OpenAdvisories
Medium VDE-2024-065 1 CVE

PEPPERL+FUCHS: HMI devices are affected by Insecure Platform Key

Published Nov 26, 2024 · Updated May 14, 2025 · Revision 2

Vendor: Pepperl+Fuchs Product: BTC22-NA-1BA1-NN0 Product: BTC22-NA-1BAJ-NN0 Product: BTC24-NA-1AA1-NN0 Product: BTC24-NA-1AAJ-NN0

Summary

A vulnerability in the use of hard-coded Platform Keys (PK) within the UEFI framework, known as PKfail, has been discovered in several Pepperl+Fuchs devices.

Details

Impact
An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.

Mitigation
Protect the device from unauthorized physical access.

Remediation
Install the appropiate updates from the Pepperl+Fuchs Homepage:
* 18-34761B (BIOS 1.01) for BTC22-*
* 18-35033B (BIOS 1.01) for BTC24-*
* 18-34132C (BIOS 1.02) for RM-320*
* 18-34132C / 18-34133E (BIOS 1.02) for PC320*

Vulnerabilities 1

  • Medium 6.4
    CVE-2024-8105

    Insecure Platform Key (PK) used in UEFI system firmware signature

    A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affe…

    Dell Acer Aopen inspiron-15-3510-laptop

Revision history

  1. #2

    Fix: version space

  2. #1

    Initial revision.

References