A BIOS vendor test key is present in the UEFI Secure Boot key database of certain Siemens SIMATIC IPC devices, allowing a local attacker with physical or administrative access to boot an operating system or UEFI application signed with that test key. This bypasses the intended Secure Boot protections even when Secure Boot is enabled, leading to a full loss of confidentiality, integrity, and availability of the device.

Affected Siemens SIMATIC IPC devices include the BX-21A, RW-543A, IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G. Versions under V31.01.13 for BX-21A, under V1.1.4 for RW-543A, and under V28.01.15 for the IPC series are vulnerable.

The CVSS score of 8.4 classifies this issue as high severity. Because the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the likelihood of exploitation depends on the presence of a local or administrative attacker. The attack vector is local, requiring physical presence or privileged access, and the potential impact is complete compromise of the targeted device.