OTPulse

Siemens SIPLUS and SIMATIC Products

Act NowCVSS 7.8ICS-CERT ICSA-26-265-04Sep 8, 2026
SiemensManufacturing
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

The "Copy Fail" vulnerability is a privilege escalation flaw in the Linux subsystem of multiple Siemens HMI panels and industrial computing products. An attacker with local shell access could execute arbitrary code with elevated privileges, potentially controlling operator interfaces and connected industrial processes. Siemens has released firmware updates for most affected products (version 21 Update 2 SR1 or later for MTP series; version 6.0 for CN 4100; version 21 SP2 Update 1 for certain SIPLUS MTP700 variants). Products with only mitigations available include SIMATIC AX Runtime Core (multiple variants), IoT2050 Advanced, IPC Industrial Edge Device OS, and S7-1500 MFP. Temporary countermeasures include restricting shell access to trusted personnel and ensuring applications come from trusted sources.

What this means
What could happen
An attacker with local access to the Linux subsystem on these HMI panels and industrial computers could execute arbitrary code with elevated privileges, gaining control over the operator interface and potentially the connected industrial processes like production lines, pump stations, or automated systems.
Who's at risk
Manufacturing facilities using Siemens HMI operator panels (SIMATIC MTP series with sizes 400 to 2200), SIPLUS ruggedized HMI panels, SIMATIC CN industrial computers, IoT2050 edge devices, IPC Industrial Edge Device OS, and S7-1500 MFP modules. These are the human-machine interfaces and edge computers in production lines, batch processes, utility control systems, and industrial automation networks.
How it could be exploited
An attacker with local shell access to the Linux subsystem of an affected HMI panel could exploit privilege escalation to run code with elevated privileges. This could allow modification of display screens, alarms, setpoints, or commands sent to connected PLCs and controllers. The vulnerability is actively being exploited in the wild.
Prerequisites
  • Local shell access to the Linux subsystem on the affected HMI panel or industrial edge device
  • Ability to execute commands on the device (e.g., through remote desktop, SSH, or local console access)
actively exploited (KEV)locally exploitableno authentication required for local accessprivilege escalationhigh EPSS score (99.9%)affects operator control interfaces
Exploitability
Actively exploited — confirmed by CISA KEV
Metasploit module available — weaponized exploitView module ↗
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (67)
60 with fix7 pending
ProductAffected VersionsFix Status
SIMATIC AX Runtime Core Linux Common DebianAll versionsNo fix yet
SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1) < V21.2.1< 21.0.2.121 Update 2 SR1
SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) < V21.2.1< 21.0.2.121 Update 2 SR1
SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) < V21.2.1< 21.0.2.121 Update 2 SR1
SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) < V21.2.1< 21.0.2.121 Update 2 SR1
Remediation & Mitigation
0/6
Do now
0/4
HOTFIXUpdate SIMATIC HMI MTP series (MTP400, MTP700, MTP1000, MTP1200, MTP1500, MTP1900, MTP2200) to version 21 Update 2 SR1 or later
HOTFIXUpdate SIPLUS HMI MTP700 products to version 21 SP2 Update 1 or later
HOTFIXUpdate SIMATC CN 4100 to version 6.0 or later
WORKAROUNDRestrict shell access to the Linux subsystem to authorized engineering and maintenance personnel only; disable or restrict remote access (SSH, remote desktop) where not operationally required
Long-term hardening
0/2
HARDENINGImplement network-level controls to limit access to HMI panels and edge devices to trusted engineering networks only
HARDENINGOnly deploy and run applications on these devices from vendor-approved or internally validated sources
View full CISA ICS-CERT advisory
API: /api/v1/advisories/a14c27cf-528f-4653-b47f-5eee3d7d2fcd

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Siemens SIPLUS and SIMATIC Products | CVSS 7.8 - OTPulse