A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in V31.01.07, V29.01.07, V32.01.04, V36.01.03, V35.01.12, and 6 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions < V36.01.03), SIMATIC IPC RC-543B (All versions < V35.01.12), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC RW-543B (All versions < V35.02.10), SIMATIC IPC127E (All versions < V27.01.11), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions < V28.01.14), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions < V28.01.14), SIMATIC IPC277G PRO (All versions < V28.01.14), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions < V21.01.21), SIMATIC IPC477E (All versions < V21.01.21), SIMATIC IPC477E PRO (All versions < V21.01.21), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to alter the secure boot configuration without proper authorization by directly communicate with the flash controller.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Siemens SIMATIC Field PG M5
All versions
- Siemens SIMATIC IPC BX-21A
fixed in V31.01.07
- Siemens SIMATIC IPC BX-32A
fixed in V29.01.07
- Siemens SIMATIC IPC BX-39A
fixed in V29.01.07
- Siemens SIMATIC IPC BX-59A
fixed in V32.01.04
- Siemens SIMATIC IPC PX-32A
fixed in V29.01.07
- Siemens SIMATIC IPC PX-39A
fixed in V29.01.07
- Siemens SIMATIC IPC PX-39A PRO
fixed in V29.01.07
- Siemens SIMATIC IPC RC-543A
fixed in V36.01.03
- Siemens SIMATIC IPC RC-543B
fixed in V35.01.12
- Siemens SIMATIC IPC RW-543A
fixed in V1.1.4
- Siemens SIMATIC IPC RW-543B
fixed in V35.02.10
- Siemens SIMATIC IPC127E
fixed in V27.01.11
- Siemens SIMATIC IPC227E
All versions
- Siemens SIMATIC IPC227G
fixed in V28.01.14
- Siemens SIMATIC IPC277E
All versions
- Siemens SIMATIC IPC277G
fixed in V28.01.14
- Siemens SIMATIC IPC277G PRO
fixed in V28.01.14
- Siemens SIMATIC IPC3000 SMART V3
All versions
- Siemens SIMATIC IPC327G
fixed in V28.01.14
- Siemens SIMATIC IPC347G
All versions
- Siemens SIMATIC IPC377G
fixed in V28.01.14
- Siemens SIMATIC IPC427E
fixed in V21.01.21
- Siemens SIMATIC IPC477E
fixed in V21.01.21
- Siemens SIMATIC IPC477E PRO
fixed in V21.01.21
- Siemens SIMATIC IPC527G
All versions
- Siemens SIMATIC IPC627E
fixed in V25.02.15
- Siemens SIMATIC IPC647E
fixed in V25.02.15
- Siemens SIMATIC IPC677E
fixed in V25.02.15
- Siemens SIMATIC IPC847E
fixed in V25.02.15
- Siemens SIMATIC ITP1000
All versions