PT-2025-10725 · Siemens · Simatic Ipc427E+25

Published 2025-03-11 · Updated 2025-03-11 · CVE-2024-56182

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC Field PG M5 versions prior to V26.01.12 SIMATIC Field PG M6 versions prior to V26.01.12 SIMATIC IPC BX-21A versions prior to V31.01.07 SIMATIC IPC BX-32A versions prior to V29.01.07 SIMATIC IPC BX-39A versions prior to V29.01.07 SIMATIC IPC BX-59A versions prior to V32.01.04 SIMATIC IPC PX-32A versions prior to V29.01.07 SIMATIC IPC PX-39A versions prior to V29.01.07 SIMATIC IPC PX-39A PRO versions prior to V29.01.07 SIMATIC IPC RC-543B (all versions) SIMATIC IPC RW-543A (all versions) SIMATIC IPC127E (all versions) SIMATIC IPC227E (all versions) SIMATIC IPC227G (all versions) SIMATIC IPC277E (all versions) SIMATIC IPC277G (all versions) SIMATIC IPC277G PRO (all versions) SIMATIC IPC3000 SMART V3 (all versions) SIMATIC IPC327G (all versions) SIMATIC IPC347G (all versions) SIMATIC IPC377G (all versions) SIMATIC IPC427E (all versions) SIMATIC IPC477E (all versions) SIMATIC IPC477E PRO (all versions) SIMATIC IPC527G (all versions) SIMATIC IPC627E versions prior to V25.02.15 SIMATIC IPC647E versions prior to V25.02.15 SIMATIC IPC677E versions prior to V25.02.15 SIMATIC IPC847E versions prior to V25.02.15 SIMATIC ITP1000 (all versions)

Description The affected devices have insufficient protection mechanisms for the EFI (Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to disable the BIOS password without proper authorization by directly communicating with the flash controller.

Recommendations For SIMATIC Field PG M5, update to version V26.01.12 or later. For SIMATIC Field PG M6, update to version V26.01.12 or later. For SIMATIC IPC BX-21A, update to version V31.01.07 or later. For SIMATIC IPC BX-32A, update to version V29.01.07 or later. For SIMATIC IPC BX-39A, update to version V29.01.07 or later. For SIMATIC IPC BX-59A, update to version V32.01.04 or later. For SIMATIC IPC PX-32A, update to version V29.01.07 or later. For SIMATIC IPC PX-39A, update to version V29.01.07 or later. For SIMATIC IPC PX-39A PRO, update to version V29.01.07 or later. For SIMATIC IPC RC-543B, SIMATIC IPC RW-543A, SIMATIC IPC127E, SIMATIC IPC227E, SIMATIC IPC227G, SIMATIC IPC277E, SIMATIC IPC277G, SIMATIC IPC277G PRO, SIMATIC IPC3000 SMART V3, SIMATIC IPC327G, SIMATIC IPC347G, SIMATIC IPC377G, SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC477E PRO, SIMATIC IPC527G, and SIMATIC ITP1000, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For SIMATIC IPC627E, SIMATIC IPC647E, SIMATIC IPC677E, and SIMATIC IPC847E, update to version V25.02.15 or later.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2025-04297

CVE-2024-56182

Affected Products

Simatic Field Pg M5

Simatic Field Pg M6

Simatic Ipc Bx-21A

Simatic Ipc Bx-32A

Simatic Ipc Bx-39A

Simatic Ipc Bx-59A

Simatic Ipc Px-39A

Simatic Ipc Rc-543B

Simatic Ipc Rw-543A

Simatic Ipc127E

Simatic Ipc227E

Simatic Ipc277E

Simatic Ipc277G Pro

Simatic Ipc3000 Smart V3

Simatic Ipc327G

Simatic Ipc347G

Simatic Ipc377G

Simatic Ipc427E

Simatic Ipc477E

Simatic Ipc477E Pro

Simatic Ipc527G

Simatic Ipc627E

Simatic Ipc647E

Simatic Ipc677E

Simatic Ipc847E

Simatic Itp1000

References · 9

• https://bdu.fstec.ru/vul/2025-04297 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-56182 · Security Note
• https://twitter.com/CveFindCom/status/1899400819654430882 · Twitter Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-216014.pdf · Note
• https://cert-portal.siemens.com/productcert/html/ssa-216014.html · Note
• https://twitter.com/cybercronai/status/1899433993239433289 · Twitter Post
• https://t.me/cvetracker/18913 · Telegram Post
• https://twitter.com/vulns_space/status/1899408398313033811 · Twitter Post
• https://twitter.com/CVEnew/status/1899404051713810804 · Twitter Post