Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5

Act Now9.8SSA-082556Jun 10, 2025

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Multiple critical vulnerabilities exist in the GNU/Linux subsystem embedded in SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP firmware version V3.1.5 and later. The vulnerabilities include memory corruption flaws (buffer overflow, use-after-free, integer overflow), command injection, and improper input validation (CWE-20, CWE-78, CWE-125, CWE-416, CWE-121, and 42 additional CWEs). These allow unauthenticated remote attackers to execute arbitrary code on the CPU's Linux subsystem. Siemens is preparing fix versions. Until patches are available, network access controls and operational hardening are required.

What this means

What could happen

An attacker with network access to the S7-1500 CPU can exploit multiple memory and command injection vulnerabilities to gain remote code execution on the embedded Linux subsystem, potentially allowing modification of control logic, process parameters, or triggering a denial of service that halts production operations.

Who's at risk

This impacts organizations operating SIMATIC S7-1500 CPU 1518 and 1518F controllers in manufacturing plants, water utilities, power distribution, and other critical infrastructure using Siemens automation equipment. Any facility relying on these CPUs for process control—including setpoint management, valve control, pump operations, or batch sequencing—should immediately implement network isolation controls.

How it could be exploited

An attacker sends a specially crafted network packet to the CPU's Ethernet port targeting the GNU/Linux subsystem. The vulnerability in input validation (CWE-20) combined with memory corruption flaws (CWE-125, CWE-416, CWE-121) allows execution of arbitrary code without authentication. Once code is running on the Linux subsystem, the attacker can issue OS commands to access or manipulate the PLC's control logic and data.

Prerequisites

Network access to the S7-1500 CPU Ethernet port (TCP/UDP)
No credentials or authentication required

Remotely exploitableNo authentication requiredLow complexity attackActively exploited (KEV)Critical CVSS score (9.8)High EPSS score (94.4%)No patch available yetAffects industrial control systems

Exploitability

Actively exploited — confirmed by CISA KEV

Affected products (3)

3 EOL

ProductAffected VersionsFix Status

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP≥ 3.1.5No fix (EOL)

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP≥ 3.1.5No fix (EOL)

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP≥ 3.1.5No fix (EOL)

Remediation & Mitigation

0/4

Do now

0/3

WORKAROUNDImplement network segmentation using firewalls to restrict access to the S7-1500 CPU to only trusted engineering workstations and HMI systems. Block unauthorized inbound connections to the device.

HARDENINGDisable unused services and ports on the S7-1500 if possible via device configuration to reduce the attack surface.

HOTFIXMonitor Siemens security advisories for firmware updates. When a patched version becomes available, schedule a maintenance window to upgrade the CPU firmware immediately.

Mitigations - no patch available

0/1

The following products have reached End of Life with no planned fix: SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Apply the following compensating controls:

HARDENINGFollow Siemens' operational guidelines for Industrial Security: configure the operating environment with defense-in-depth controls including DMZ, air-gapping critical networks, and network access controls.

CVEs (148)

CVE-2021-41617 CVE-2023-4527 CVE-2023-4806 CVE-2023-4911 CVE-2023-5363 CVE-2023-6246 CVE-2023-6779 CVE-2023-6780 CVE-2023-28531 CVE-2023-38545 CVE-2023-38546 CVE-2023-44487 CVE-2023-46218 CVE-2023-46219 CVE-2023-48795 CVE-2023-51384 CVE-2023-51385 CVE-2023-52927 CVE-2024-2961 CVE-2024-6119 CVE-2024-6387 CVE-2024-12133 CVE-2024-12243 CVE-2024-24855 CVE-2024-26596 CVE-2024-28085 CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602 CVE-2024-34397 CVE-2024-37370 CVE-2024-37371 CVE-2024-45490 CVE-2024-45491 CVE-2024-45492 CVE-2024-50246 CVE-2024-53166 CVE-2024-57924 CVE-2024-57977 CVE-2024-57996 CVE-2024-58005 CVE-2025-3198 CVE-2025-4373 CVE-2025-4598 CVE-2025-5244 CVE-2025-5245 CVE-2025-6395 CVE-2025-7425 CVE-2025-7545 CVE-2025-7546 CVE-2025-8224 CVE-2025-9230 CVE-2025-9232 CVE-2025-11082 CVE-2025-11083 CVE-2025-11412 CVE-2025-11413 CVE-2025-11414 CVE-2025-11494 CVE-2025-11495 CVE-2025-11839 CVE-2025-11840 CVE-2025-21701 CVE-2025-21702 CVE-2025-21712 CVE-2025-21724 CVE-2025-21728 CVE-2025-21745 CVE-2025-21756 CVE-2025-21758 CVE-2025-21765 CVE-2025-21766 CVE-2025-21767 CVE-2025-21795 CVE-2025-21796 CVE-2025-21848 CVE-2025-21862 CVE-2025-21864 CVE-2025-21865 CVE-2025-26465 CVE-2025-31115 CVE-2025-32988 CVE-2025-32989 CVE-2025-38058 CVE-2025-38063 CVE-2025-38067 CVE-2025-38071 CVE-2025-38079 CVE-2025-38083 CVE-2025-38100 CVE-2025-38111 CVE-2025-38124 CVE-2025-38167 CVE-2025-38198 CVE-2025-38212 CVE-2025-38214 CVE-2025-38215 CVE-2025-38222 CVE-2025-38231 CVE-2025-38236 CVE-2025-38280 CVE-2025-38285 CVE-2025-38312 CVE-2025-38342 CVE-2025-38350 CVE-2025-38364 CVE-2025-38393 CVE-2025-38400 CVE-2025-38430 CVE-2025-38451 CVE-2025-38457 CVE-2025-38465 CVE-2025-38466 CVE-2025-38468 CVE-2025-38470 CVE-2025-38471 CVE-2025-38477 CVE-2025-38498 CVE-2025-38499 CVE-2025-38614 CVE-2025-38685 CVE-2025-38691 CVE-2025-38701 CVE-2025-38702 CVE-2025-38708 CVE-2025-38721 CVE-2025-38724 CVE-2025-38727 CVE-2025-39683 CVE-2025-39689 CVE-2025-39697 CVE-2025-39724 CVE-2025-39756 CVE-2025-39770 CVE-2025-39773 CVE-2025-39783 CVE-2025-39787 CVE-2025-39795 CVE-2025-39798 CVE-2025-39866 CVE-2025-39929 CVE-2025-39931 CVE-2025-39977 CVE-2025-40022 CVE-2025-46836 CVE-2025-59375 CVE-2025-66382

View full Siemens ProductCERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/8a00d590-fddc-4a33-ab65-0c2bf2bf2e27