OTPulse

Siemens SIMATIC S7-PLCSIM Advanced

MonitorCVSS 7.4ICS-CERT ICSA-26-209-03Jul 14, 2026
SiemensManufacturing
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

SIMATIC S7-PLCSIM Advanced contains a denial of service vulnerability that allows an attacker on the same network segment to crash the simulator process by sending malicious multicast packets to the Virtual Switch binding. All versions are affected. Siemens is preparing patches and recommends disabling the Virtual Switch binding, restricting multicast traffic, or using Softbus/PLCSIM network mode (the default).

What this means
What could happen
An attacker on the same network segment could send crafted packets to crash SIMATIC S7-PLCSIM Advanced, disrupting simulation and testing of PLC logic that controls manufacturing processes.
Who's at risk
Manufacturing companies using SIMATIC S7-PLCSIM Advanced for PLC simulation and offline testing. This affects engineering teams and automation departments that rely on the simulator for validation before deploying logic to production PLCs.
How it could be exploited
An attacker with access to the network segment hosting the SIMATIC S7-PLCSIM Advanced instance sends malicious multicast packets targeting the Virtual Switch binding. The vulnerability in packet handling causes the simulator process to crash, halting any PLC simulations in progress.
Prerequisites
  • Network access to the same network segment as the SIMATIC S7-PLCSIM Advanced host
  • S7-PLCSIM Virtual Switch binding enabled on a network adapter
  • No multicast traffic filtering in place
remotely exploitablelow complexityno authentication requiredaffects manufacturing operations
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
SIMATIC S7-PLCSIM AdvancedAll versionsNo fix yet
Remediation & Mitigation
0/3
Do now
0/2
WORKAROUNDDisable the S7-PLCSIM Virtual Switch binding on all network adapters used by SIMATIC S7-PLCSIM Advanced instances
WORKAROUNDConfigure network switches or firewall rules to restrict multicast traffic on segments hosting SIMATIC S7-PLCSIM Advanced
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HARDENINGEnsure SIMATIC S7-PLCSIM Advanced is configured to use Softbus/PLCSIM network mode (the default setting)
View full CISA ICS-CERT advisory
API: /api/v1/advisories/763410c9-515d-4580-b42e-cfe9659c21e2

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.