Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

Act NowCVSS 9.8ICS-CERT ICSA-26-209-04Jul 14, 2026

SiemensManufacturing

Attack path

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Multiple vulnerabilities exist in the embedded GNU/Linux subsystem of firmware version V3.1.6 and later for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (including SIPLUS variant). These vulnerabilities span input validation, memory management, race conditions, and other critical flaws in the Linux kernel and applications. Siemens is preparing patch versions and recommends access controls as interim mitigation.

What this means

What could happen

An unauthenticated attacker with network access to the embedded Linux subsystem in these PLCs could execute arbitrary code and gain full control of the controller, potentially stopping production, altering setpoints, or corrupting configuration.

Who's at risk

Manufacturers and operators of water treatment plants, electric utilities, and industrial facilities using Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP controllers for process control, monitoring, or critical automation. This affects both standard and SIPLUS (hardened) variants.

How it could be exploited

An attacker can send malicious network traffic to the PLC's embedded Linux subsystem without authentication. The vulnerabilities in the Linux subsystem allow arbitrary code execution. Once code runs on the CPU, the attacker can modify or disable the control logic and interfere with production processes.

Prerequisites

Network reachability to the S7-1500 CPU 1518(F)-4 PN/DP MFP on the Ethernet port
Firmware version 3.1.6 or later installed
No firewall rules blocking traffic to the Linux subsystem services

remotely exploitableno authentication requiredlow complexityactively exploited (KEV)extremely high EPSS score (94.5%)no patch available yetaffects core control system

Exploitability

Actively exploited — confirmed by CISA KEV

Metasploit module available — weaponized exploitView module ↗

Public Proof-of-Concept (PoC) on GitHub (10 repositories)

Affected products (72)

60 with fix12 pending

ProductAffected VersionsFix Status

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= V3.1.6≥ 3.1.6No fix yet

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= V3.1.6≥ 3.1.6No fix yet

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= V3.1.6≥ 3.1.6No fix yet

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= V3.1.6≥ 3.1.6No fix yet

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= V3.1.6≥ 3.1.6No fix yet

Remediation & Mitigation

0/4

Do now

0/3

HARDENINGIsolate the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP affected units on a separate PLC network segment with firewall rules blocking unnecessary inbound traffic until a vendor fix is available

WORKAROUNDRestrict network access to the Linux subsystem interactive shell to authorized engineering personnel only; disable remote shell access from untrusted networks

HARDENINGRun only applications and firmware updates from verified, trusted sources; validate authenticity before deployment

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HOTFIXMonitor Siemens security advisories for the availability of patched firmware versions and schedule deployment during a maintenance window

CVEs (352)

CVE-2021-41617 CVE-2023-28531 CVE-2023-51384 CVE-2023-52927 CVE-2024-26783 CVE-2024-27056 CVE-2024-28956 CVE-2024-36903 CVE-2024-36927 CVE-2024-42079 CVE-2024-46786 CVE-2024-47736 CVE-2024-47809 CVE-2024-49968 CVE-2024-49994 CVE-2024-49998 CVE-2024-50014 CVE-2024-50063 CVE-2024-50164 CVE-2024-50298 CVE-2024-53124 CVE-2024-53170 CVE-2024-54458 CVE-2024-56631 CVE-2024-56703 CVE-2024-56719 CVE-2024-57917 CVE-2024-57924 CVE-2024-57973 CVE-2024-57977 CVE-2024-57979 CVE-2024-58011 CVE-2024-58016 CVE-2024-58020 CVE-2024-58056 CVE-2024-58058 CVE-2024-58061 CVE-2024-58086 CVE-2025-21645 CVE-2025-21648 CVE-2025-21655 CVE-2025-21676 CVE-2025-21682 CVE-2025-21702 CVE-2025-21705 CVE-2025-21706 CVE-2025-21707 CVE-2025-21718 CVE-2025-21731 CVE-2025-21745 CVE-2025-21758 CVE-2025-21760 CVE-2025-21764 CVE-2025-21765 CVE-2025-21780 CVE-2025-21795 CVE-2025-21796 CVE-2025-21802 CVE-2025-21814 CVE-2025-21846 CVE-2025-21853 CVE-2025-21861 CVE-2025-21864 CVE-2025-21867 CVE-2025-21875 CVE-2025-21887 CVE-2025-21913 CVE-2025-21919 CVE-2025-21925 CVE-2025-21926 CVE-2025-21938 CVE-2025-21959 CVE-2025-21999 CVE-2025-22005 CVE-2025-22015 CVE-2025-22055 CVE-2025-22056 CVE-2025-22060 CVE-2025-22083 CVE-2025-22090 CVE-2025-22095 CVE-2025-22107 CVE-2025-22111 CVE-2025-22121 CVE-2025-23136 CVE-2025-23143 CVE-2025-37785 CVE-2025-37909 CVE-2025-37917 CVE-2025-37945 CVE-2025-37959 CVE-2025-37964 CVE-2025-37972 CVE-2025-37980 CVE-2025-38125 CVE-2025-38162 CVE-2025-38192 CVE-2025-38201 CVE-2025-38232 CVE-2025-38322 CVE-2025-38591 CVE-2025-38614 CVE-2025-38681 CVE-2025-38704 CVE-2025-38721 CVE-2025-38725 CVE-2025-38727 CVE-2025-38732 CVE-2025-38736 CVE-2025-39681 CVE-2025-39691 CVE-2025-39721 CVE-2025-39748 CVE-2025-39756 CVE-2025-39764 CVE-2025-39770 CVE-2025-39773 CVE-2025-39782 CVE-2025-39795 CVE-2025-39826 CVE-2025-39827 CVE-2025-39845 CVE-2025-39866 CVE-2025-39871 CVE-2025-39931 CVE-2025-39953 CVE-2025-39955 CVE-2025-39964 CVE-2025-39977 CVE-2025-39978 CVE-2025-39980 CVE-2025-40022 CVE-2025-40070 CVE-2025-40078 CVE-2025-40080 CVE-2025-40105 CVE-2025-40135 CVE-2025-40149 CVE-2025-40219 CVE-2025-40261 CVE-2025-40300 CVE-2025-61984 CVE-2025-61985 CVE-2025-68206 CVE-2025-68261 CVE-2025-68264 CVE-2025-68265 CVE-2025-68266 CVE-2025-68291 CVE-2025-68337 CVE-2025-68349 CVE-2025-68363 CVE-2025-68371 CVE-2025-68724 CVE-2025-68725 CVE-2025-68742 CVE-2025-68764 CVE-2025-68773 CVE-2025-68776 CVE-2025-68782 CVE-2025-68787 CVE-2025-68788 CVE-2025-68798 CVE-2025-68803 CVE-2025-68814 CVE-2025-68816 CVE-2025-68818 CVE-2025-68820 CVE-2025-71064 CVE-2025-71075 CVE-2025-71079 CVE-2025-71085 CVE-2025-71086 CVE-2025-71088 CVE-2025-71095 CVE-2025-71097 CVE-2025-71098 CVE-2025-71104 CVE-2025-71112 CVE-2025-71113 CVE-2025-71114 CVE-2025-71120 CVE-2025-71123 CVE-2025-71131 CVE-2025-71161 CVE-2025-71162 CVE-2025-71163 CVE-2025-71185 CVE-2025-71186 CVE-2025-71189 CVE-2025-71190 CVE-2025-71191 CVE-2025-71197 CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267 CVE-2026-3497 CVE-2026-22977 CVE-2026-22979 CVE-2026-22980 CVE-2026-22982 CVE-2026-22992 CVE-2026-22994 CVE-2026-23003 CVE-2026-23005 CVE-2026-23010 CVE-2026-23011 CVE-2026-23019 CVE-2026-23026 CVE-2026-23038 CVE-2026-23054 CVE-2026-23060 CVE-2026-23083 CVE-2026-23084 CVE-2026-23086 CVE-2026-23087 CVE-2026-23095 CVE-2026-23100 CVE-2026-23103 CVE-2026-23110 CVE-2026-23111 CVE-2026-23113 CVE-2026-23154 CVE-2026-23204 CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273 CVE-2026-23274 CVE-2026-23277 CVE-2026-23284 CVE-2026-23287 CVE-2026-23290 CVE-2026-23293 CVE-2026-23300 CVE-2026-23304 CVE-2026-23319 CVE-2026-23321 CVE-2026-23335 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351 CVE-2026-23359 CVE-2026-23365 CVE-2026-23368 CVE-2026-23370 CVE-2026-23378 CVE-2026-23379 CVE-2026-23381 CVE-2026-23391 CVE-2026-23392 CVE-2026-23397 CVE-2026-23398 CVE-2026-23414 CVE-2026-23422 CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446 CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454 CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458 CVE-2026-23463 CVE-2026-23474 CVE-2026-23475 CVE-2026-27135 CVE-2026-31389 CVE-2026-31391 CVE-2026-31396 CVE-2026-31402 CVE-2026-31403 CVE-2026-31411 CVE-2026-31414 CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418 CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424 CVE-2026-31427 CVE-2026-31428 CVE-2026-31431 CVE-2026-31441 CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31450 CVE-2026-31452 CVE-2026-31466 CVE-2026-31469 CVE-2026-31485 CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507 CVE-2026-31508 CVE-2026-31515 CVE-2026-31518 CVE-2026-31521 CVE-2026-31533 CVE-2026-31546 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565 CVE-2026-31628 CVE-2026-31634 CVE-2026-31649 CVE-2026-31651 CVE-2026-31658 CVE-2026-31664 CVE-2026-31665 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671 CVE-2026-31674 CVE-2026-31680 CVE-2026-31682 CVE-2026-31737 CVE-2026-31752 CVE-2026-31761 CVE-2026-31768 CVE-2026-40355 CVE-2026-41989 CVE-2026-43011 CVE-2026-43024 CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028 CVE-2026-43030 CVE-2026-43033 CVE-2026-43035 CVE-2026-43038 CVE-2026-43040 CVE-2026-43057 CVE-2026-43284 CVE-2026-46174 CVE-2026-46300 CVE-2026-46333

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/2f775aa0-958b-41f5-aad7-dfdcdb317195

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.