Insyde BIOS Vulnerabilities in Siemens Industrial Products

Plan Patch8.4SSA-306654Feb 22, 2022

Attack VectorLocal

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Insyde BIOS vulnerabilities affect multiple Siemens industrial computing platforms including portable engineering stations (Field PG), industrial PCs (IPC series), and operator panels (ITP1000). The vulnerabilities enable privilege escalation, memory corruption, and information disclosure through local access to the BIOS layer. Multiple CWEs indicate memory safety issues (CWE-119, CWE-120, CWE-787), improper input validation (CWE-20), and access control flaws (CWE-269, CWE-822).

What this means

What could happen

An attacker with local access to an affected industrial PC or engineering station could modify BIOS settings or execute code at the firmware level, potentially bypassing security controls, altering system behavior, or preventing the device from operating. This affects all control and monitoring systems running on these platforms.

Who's at risk

Manufacturing and process control operations using Siemens SIMATIC industrial PCs, portable engineering stations (Field PG), and operator panels (ITP1000) are affected. This includes production facilities, water treatment plants, and utilities that rely on these devices as the computing platform for their automation and control systems. RUGGEDCOM APE1808 deployments in harsh industrial environments are also affected.

How it could be exploited

An attacker must have physical access to the device or local user-level access to the operating system to interact with BIOS. From there, they can exploit memory corruption or access control flaws to escalate privileges to BIOS/firmware level and modify system configuration or boot integrity.

Prerequisites

Local access to the industrial PC or engineering station (physical access or valid user account)
Ability to interact with BIOS interface or firmware during boot or through OS-level BIOS access tools

Local access required for exploitationLow complexity exploitationAffects multiple Siemens product linesNo patch available for several product variantsMemory corruption vulnerabilitiesAffects BIOS/firmware layer

Exploitability

Low exploit probability (EPSS 0.3%)

Affected products (28)

22 with fix6 pending

ProductAffected VersionsFix Status

SIMATIC Field PG M5< V22.01.1022.01.10

SIMATIC Field PG M5All versionsNo fix yet

SIMATIC Field PG M6< V26.01.1326.01.13

SIMATIC IPC127E< V27.01.0927.01.09

SIMATIC IPC227G< V28.01.0428.01.04

Remediation & Mitigation

0/20

Schedule — requires maintenance window

0/19

Patching may require device reboot — plan for process interruption

Long-term hardening

0/1

SIMATIC Field PG M5

HARDENINGFor products without available fixes (SIMATIC Field PG M5 all versions, SIMATIC IPC427E all versions, SIMATIC IPC477E all versions, SIMATIC IPC477E PRO all versions, SIMATIC ITP1000 all versions, SIPLUS IPC427E all versions), implement physical security controls to restrict local access to the devices and BIOS settings

CVEs (26)

View full Siemens ProductCERT advisory

↑↓ Navigate · Esc Close