Junglewise Threat Intelligence

CVE-2024-56182: Siemens SIMATIC IPC and Field PG BIOS password bypass via EFI variables

CVE-2024-56182 · Severity: high · CVSS 8.2 · Published 2025-03-11

Vendors: Siemens.

Executive brief

A security vulnerability has been identified in several Siemens industrial computing devices, including SIMATIC IPCs and Field PGs, which are used for automation and industrial control tasks. An attacker with administrative access to the device could bypass or disable the BIOS password, potentially allowing them to modify critical system startup settings. This could lead to unauthorized changes to the device's security configuration or persistent access that is difficult to detect.

Technical details

A protection mechanism failure (CWE-693) exists in the handling of Extensible Firmware Interface (EFI) variables across multiple Siemens SIMATIC product lines. The vulnerability stems from insufficient protection of EFI variables stored on the device's flash memory. An authenticated attacker with high privileges can bypass the BIOS password by communicating directly with the flash controller. This allows for unauthorized modification of BIOS/UEFI settings, including the potential to disable Secure Boot or other firmware-level security controls. Siemens has released BIOS updates for many affected models, though some legacy versions currently have no planned fix.

Affected products

  • Siemens SIMATIC Field PG M5 All versions
  • Siemens SIMATIC Field PG M6 All versions < V26.01.12
  • Siemens SIMATIC IPC BX-21A All versions < V31.01.07
  • Siemens SIMATIC IPC BX-32A All versions < V29.01.07
  • Siemens SIMATIC IPC BX-39A All versions < V29.01.07
  • Siemens SIMATIC IPC BX-59A All versions < V32.01.04
  • Siemens SIMATIC IPC PX-32A All versions < V29.01.07
  • Siemens SIMATIC IPC PX-39A All versions < V29.01.07
  • Siemens SIMATIC IPC PX-39A PRO All versions < V29.01.07
  • Siemens SIMATIC IPC RC-543A All versions < V36.01.03
  • Siemens SIMATIC IPC RC-543B All versions < V35.01.12
  • Siemens SIMATIC IPC RW-543A All versions < V1.1.4
  • Siemens SIMATIC IPC RW-543B All versions < V35.02.10
  • Siemens SIMATIC IPC127E All versions < V27.01.11
  • Siemens SIMATIC IPC227E All versions
  • Siemens SIMATIC IPC227G All versions < V28.01.14
  • Siemens SIMATIC IPC277E All versions
  • Siemens SIMATIC IPC277G All versions < V28.01.14
  • Siemens SIMATIC IPC277G PRO All versions < V28.01.14
  • Siemens SIMATIC IPC3000 SMART V3 All versions
  • Siemens SIMATIC IPC327G All versions < V28.01.14
  • Siemens,versions: SIMATIC IPC347G

Timeline

  • 2025-03-11: disclosed
  • 2025-03-11: advisory
  • 2026-05-12: other: Last advisory update

References

Related threats