Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

Act Now9.1SSA-265688Apr 9, 2024

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Multiple vulnerabilities exist in the GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1, including buffer overflows (CWE-787, CWE-120), out-of-bounds reads (CWE-125), integer overflows (CWE-190), and improper input validation (CWE-20). These flaws can be triggered remotely without authentication via network requests to the affected subsystem. Siemens states that fixes are being prepared but not yet available.

What this means

What could happen

An attacker with network access to the S7-1500 TM MFP could execute arbitrary code or crash the device due to multiple memory safety and input validation flaws in the Linux subsystem. This could disrupt control logic execution, alter process parameters, or halt manufacturing operations.

Who's at risk

Manufacturing facilities and process industries using SIMATIC S7-1500 TM MFP programmable logic controllers (PLCs) for automation, process control, and machine coordination. This affects any organization relying on these controllers for critical production or safety systems.

How it could be exploited

An attacker sends malicious network traffic to the S7-1500 TM MFP's Linux subsystem, exploiting buffer overflows, integer overflows, or unvalidated input to gain code execution or cause a denial of service.

Prerequisites

Network access to the S7-1500 TM MFP on the port(s) exposed by the Linux subsystem
No authentication required

remotely exploitableno authentication requiredlow complexityactively exploited (KEV)no patch availableaffects control system operations

Exploitability

Actively exploited — confirmed by CISA KEV

Affected products (1)

ProductAffected VersionsFix Status

SIMATIC S7-1500 TM MFP - GNU/Linux subsystemAll versionsNo fix (EOL)

Remediation & Mitigation

0/4

Do now

0/2

HARDENINGRestrict network access to the S7-1500 TM MFP using firewall rules to allow only authorized workstations and control systems

HARDENINGImplement network segmentation to isolate the S7-1500 TM MFP on a separate OT network from corporate IT and untrusted systems

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HOTFIXMonitor Siemens security advisories for patched firmware versions and apply when available

Mitigations - no patch available

0/1

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:

HARDENINGReview and apply Siemens' operational guidelines for Industrial Security to reduce attack surface

CVEs (452)

CVE-2021-4090 CVE-2021-38202 CVE-2021-47002 CVE-2021-47107 CVE-2021-47316 CVE-2022-38096 CVE-2022-43945 CVE-2022-48827 CVE-2022-48828 CVE-2022-48829 CVE-2023-1652 CVE-2023-5678 CVE-2023-6121 CVE-2023-6129 CVE-2023-6237 CVE-2023-6817 CVE-2023-6931 CVE-2023-6932 CVE-2023-28746 CVE-2023-45898 CVE-2023-47233 CVE-2023-50781 CVE-2023-52447 CVE-2023-52458 CVE-2023-52614 CVE-2023-52620 CVE-2024-0584 CVE-2024-0727 CVE-2024-2511 CVE-2024-5535 CVE-2024-9143 CVE-2024-22099 CVE-2024-23307 CVE-2024-23848 CVE-2024-24857 CVE-2024-24858 CVE-2024-24859 CVE-2024-25739 CVE-2024-26629 CVE-2024-26642 CVE-2024-26643 CVE-2024-26651 CVE-2024-26659 CVE-2024-26787 CVE-2024-26810 CVE-2024-26812 CVE-2024-26816 CVE-2024-26820 CVE-2024-26851 CVE-2024-26852 CVE-2024-26855 CVE-2024-26859 CVE-2024-26861 CVE-2024-26863 CVE-2024-26870 CVE-2024-26872 CVE-2024-26875 CVE-2024-26877 CVE-2024-26878 CVE-2024-26880 CVE-2024-26882 CVE-2024-26883 CVE-2024-26884 CVE-2024-26885 CVE-2024-26889 CVE-2024-26891 CVE-2024-26894 CVE-2024-26895 CVE-2024-26897 CVE-2024-26898 CVE-2024-26901 CVE-2024-26903 CVE-2024-26906 CVE-2024-26907 CVE-2024-26920 CVE-2024-26923 CVE-2024-26925 CVE-2024-26934 CVE-2024-26935 CVE-2024-26937 CVE-2024-26950 CVE-2024-26951 CVE-2024-26958 CVE-2024-26960 CVE-2024-26961 CVE-2024-26973 CVE-2024-26974 CVE-2024-26982 CVE-2024-26988 CVE-2024-26993 CVE-2024-27004 CVE-2024-27013 CVE-2024-27020 CVE-2024-27024 CVE-2024-27025 CVE-2024-27038 CVE-2024-27047 CVE-2024-27052 CVE-2024-27053 CVE-2024-27059 CVE-2024-27065 CVE-2024-27072 CVE-2024-27076 CVE-2024-27077 CVE-2024-27078 CVE-2024-27395 CVE-2024-27396 CVE-2024-27397 CVE-2024-27419 CVE-2024-27431 CVE-2024-27436 CVE-2024-27437 CVE-2024-33621 CVE-2024-33847 CVE-2024-34027 CVE-2024-35789 CVE-2024-35805 CVE-2024-35807 CVE-2024-35811 CVE-2024-35813 CVE-2024-35815 CVE-2024-35823 CVE-2024-35828 CVE-2024-35845 CVE-2024-35849 CVE-2024-35877 CVE-2024-35884 CVE-2024-35886 CVE-2024-35888 CVE-2024-35893 CVE-2024-35895 CVE-2024-35896 CVE-2024-35897 CVE-2024-35898 CVE-2024-35899 CVE-2024-35900 CVE-2024-35902 CVE-2024-35905 CVE-2024-35910 CVE-2024-35915 CVE-2024-35922 CVE-2024-35925 CVE-2024-35930 CVE-2024-35933 CVE-2024-35934 CVE-2024-35935 CVE-2024-35936 CVE-2024-35940 CVE-2024-35944 CVE-2024-35950 CVE-2024-35955 CVE-2024-35958 CVE-2024-35960 CVE-2024-35962 CVE-2024-35965 CVE-2024-35966 CVE-2024-35967 CVE-2024-35969 CVE-2024-35973 CVE-2024-35976 CVE-2024-35978 CVE-2024-35982 CVE-2024-35983 CVE-2024-35984 CVE-2024-35988 CVE-2024-35990 CVE-2024-35996 CVE-2024-35997 CVE-2024-36004 CVE-2024-36005 CVE-2024-36006 CVE-2024-36007 CVE-2024-36008 CVE-2024-36020 CVE-2024-36270 CVE-2024-36286 CVE-2024-36288 CVE-2024-36484 CVE-2024-36489 CVE-2024-36894 CVE-2024-36899 CVE-2024-36902 CVE-2024-36904 CVE-2024-36905 CVE-2024-36916 CVE-2024-36929 CVE-2024-36939 CVE-2024-36940 CVE-2024-36959 CVE-2024-36974 CVE-2024-36978 CVE-2024-37356 CVE-2024-38381 CVE-2024-38547 CVE-2024-38552 CVE-2024-38558 CVE-2024-38559 CVE-2024-38560 CVE-2024-38565 CVE-2024-38567 CVE-2024-38578 CVE-2024-38579 CVE-2024-38587 CVE-2024-38589 CVE-2024-38596 CVE-2024-38598 CVE-2024-38599 CVE-2024-38612 CVE-2024-38615 CVE-2024-38619 CVE-2024-38635 CVE-2024-38659 CVE-2024-38662 CVE-2024-38780 CVE-2024-39468 CVE-2024-39482 CVE-2024-39489 CVE-2024-39493 CVE-2024-39502 CVE-2024-39503 CVE-2024-39509 CVE-2024-40905 CVE-2024-40912 CVE-2024-40916 CVE-2024-40934 CVE-2024-40941 CVE-2024-40942 CVE-2024-40945 CVE-2024-40958 CVE-2024-40959 CVE-2024-40960 CVE-2024-40961 CVE-2024-40971 CVE-2024-40978 CVE-2024-40980 CVE-2024-40984 CVE-2024-40993 CVE-2024-40995 CVE-2024-41000 CVE-2024-41004 CVE-2024-41005 CVE-2024-41006 CVE-2024-41016 CVE-2024-41996 CVE-2024-42070 CVE-2024-42082 CVE-2024-42090 CVE-2024-42093 CVE-2024-42094 CVE-2024-42096 CVE-2024-42097 CVE-2024-42114 CVE-2024-42259 CVE-2024-42265 CVE-2024-42272 CVE-2024-42276 CVE-2024-42281 CVE-2024-42283 CVE-2024-42292 CVE-2024-42302 CVE-2024-42304 CVE-2024-42305 CVE-2024-42306 CVE-2024-42312 CVE-2024-43828 CVE-2024-43830 CVE-2024-43834 CVE-2024-43856 CVE-2024-43858 CVE-2024-43871 CVE-2024-43879 CVE-2024-43882 CVE-2024-43889 CVE-2024-43890 CVE-2024-43893 CVE-2024-44935 CVE-2024-44944 CVE-2024-44948 CVE-2024-44960 CVE-2024-44987 CVE-2024-44989 CVE-2024-44990 CVE-2024-45016 CVE-2024-45018 CVE-2024-46679 CVE-2024-46743 CVE-2024-46744 CVE-2024-46745 CVE-2024-46750 CVE-2024-46759 CVE-2024-46783 CVE-2024-46854 CVE-2024-46865 CVE-2024-47660 CVE-2024-47672 CVE-2024-47684 CVE-2024-47685 CVE-2024-47692 CVE-2024-47696 CVE-2024-47697 CVE-2024-47699 CVE-2024-47701 CVE-2024-47705 CVE-2024-47706 CVE-2024-47707 CVE-2024-47709 CVE-2024-47710 CVE-2024-47713 CVE-2024-47718 CVE-2024-47723 CVE-2024-47735 CVE-2024-47737 CVE-2024-47747 CVE-2024-49851 CVE-2024-49889 CVE-2024-49890 CVE-2024-49892 CVE-2024-49894 CVE-2024-49900 CVE-2024-49902 CVE-2024-49903 CVE-2024-49930 CVE-2024-49938 CVE-2024-49944 CVE-2024-49948 CVE-2024-49949 CVE-2024-49952 CVE-2024-49955 CVE-2024-49973 CVE-2024-49977 CVE-2024-49997 CVE-2024-50001 CVE-2024-50006 CVE-2024-50008 CVE-2024-50010 CVE-2024-50015 CVE-2024-50033 CVE-2024-50035 CVE-2024-50039 CVE-2024-50040 CVE-2024-50044 CVE-2024-50045 CVE-2024-50046 CVE-2024-50058 CVE-2024-50095 CVE-2024-50121 CVE-2024-50127 CVE-2024-50131 CVE-2024-50134 CVE-2024-50142 CVE-2024-50148 CVE-2024-50150 CVE-2024-50151 CVE-2024-50153 CVE-2024-50188 CVE-2024-50205 CVE-2024-50210 CVE-2024-50251 CVE-2024-50262 CVE-2024-50299 CVE-2024-50301 CVE-2024-50302 CVE-2024-53042 CVE-2024-53057 CVE-2024-53059 CVE-2024-53101 CVE-2024-53124 CVE-2024-56631 CVE-2024-56672 CVE-2024-57901 CVE-2024-57902 CVE-2024-57913 CVE-2024-57929 CVE-2024-57940 CVE-2024-57948 CVE-2024-57951 CVE-2024-57977 CVE-2024-57979 CVE-2024-57981 CVE-2024-57986 CVE-2024-58005 CVE-2024-58009 CVE-2024-58014 CVE-2024-58016 CVE-2024-58017 CVE-2024-58020 CVE-2024-58051 CVE-2024-58058 CVE-2024-58063 CVE-2024-58071 CVE-2024-58072 CVE-2024-58085 CVE-2025-3198 CVE-2025-5244 CVE-2025-5245 CVE-2025-7425 CVE-2025-7545 CVE-2025-7546 CVE-2025-8224 CVE-2025-9230 CVE-2025-21638 CVE-2025-21639 CVE-2025-21640 CVE-2025-21647 CVE-2025-21648 CVE-2025-21653 CVE-2025-21664 CVE-2025-21666 CVE-2025-21669 CVE-2025-21678 CVE-2025-21683 CVE-2025-21692 CVE-2025-21694 CVE-2025-21704 CVE-2025-21711 CVE-2025-21719 CVE-2025-21726 CVE-2025-21727 CVE-2025-21728 CVE-2025-21735 CVE-2025-21744 CVE-2025-21745 CVE-2025-21753 CVE-2025-21756 CVE-2025-21760 CVE-2025-21761 CVE-2025-21762 CVE-2025-21763 CVE-2025-21764 CVE-2025-21765 CVE-2025-21772 CVE-2025-21776 CVE-2025-21787 CVE-2025-21795 CVE-2025-21796 CVE-2025-21806 CVE-2025-21814 CVE-2025-21826 CVE-2025-21835 CVE-2025-21844 CVE-2025-21846 CVE-2025-21858 CVE-2025-21859 CVE-2025-21862 CVE-2025-21865 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420 CVE-2025-69421 CVE-2026-22795 CVE-2026-22796

View full Siemens ProductCERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/c3dd96a9-17ca-4a6e-ac09-35939e5b4953