Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

CCISA Advisories · 8 hours ago

View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.7 SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) vers:intdot/>=3.1.7  SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) vers:intdot/>=3.1.7  SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) vers:intdot/>=3.1.7  SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) vers:intdot/>=3.1.7  CVSS Vendor Equipment v3 10 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) 428 Vulnerabilities Access of Resource Using Incompatible Type ('Type Confusion'), Access of Uninitialized Pointer, Active Debug Code, Buffer Access with Incorrect Length Value, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Buffer Underwrite ('Buffer Underflow'), Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Deadlock, Divide By Zero, Expired Pointer Dereference, Exposure of Sensitive Information Due to Incompatible Policies, Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution, Improper Enforcement of Behavioral Workflow, Improper Following of Specification by Caller, Improper Handling of Invalid Use of Special Elements, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Neutralization of Null Byte or NUL Character, Improper Null Termination, Improper Privilege Management, Improper Resource Locking, Improper Resource Shutdown or Release, Improper Update of Reference Count, Improper Validation of Specified Index, Position, or Offset in Input, Improper Validation of Specified Quantity in Input, Improper Validation of Specified Type of Input, Improperly Implemented Security Check for Standard, Incomplete Cleanup, Incomplete Internal State Distinction, Incorrect Calculation of Buffer Size, Incorrect Conversion between Numeric Types, Incorrect Privilege Assignment, Incorrect Synchronization, Incorrect Type Conversion or Cast, Integer Overflow or Wraparound, Loop with Unreachable Exit Condition ('Infinite Loop'), Memory Allocation with Excessive Size Value, Misinterpretation of Input, Missing Critical Step in Authentication, Missing Default Case in Multiple Condition Expression, Missing Encryption of Sensitive Data, Missing Initialization of Resource, Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Missing Report of Error Condition, Missing Synchronization, Multiple Releases of Same Resource or Handle, NULL Pointer Dereference, Operation on a Resource after Expiration or Release, Out-of-bounds Read, Out-of-bounds Write, Plaintext Storage of a Password, Race Condition within a Thread, Reachable Assertion, Release of Invalid Pointer or Reference, Signal Handler Race Condition, Time-of-check Time-of-use (TOCTOU) Race Condition, Transmission of Private Resources into a New Sphere ('Resource Leak'), Trust of System Event Data, Unchecked Return Value, Uncontrolled Recursion, Untrusted Pointer Dereference, Use After Free, Use of Externally-Controlled Format String, Use of Uninitialized Resource, Use of Uninitialized Variable, Write-what-where Condition Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2021-41617 sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Read More 5 Affected Products SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= V3.1.7 Product Status: known_affected Remediations MitigationLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. MitigationOnly build and run applications from trusted sources. None availableCurrently no fix is available SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= V3.1.7 Product Status: known_affected Remediations MitigationLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. MitigationOnly build and run applications from trusted sources. None availableCurrently no fix is available SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= V3.1.7 Product Status: known_affected Remediations MitigationLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. MitigationOnly build and run applications from trusted sources. None availableCurrently no fix is available SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= V3.1.7 Product Status: known_affected Remediations MitigationLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. MitigationOnly build and run applications from trusted sources. None availableCurrently no fix is available SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= V3.1.7 Product Status: known_affected Remediations MitigationLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. MitigationOnly build and run applications from trusted sources. None availableCurrently no fix is available Additional Metrics Relevant CWE: CWE-311 Missing Encryption of Sensitive Data CVSS Version Base Score Base Severity Vector String 3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2021-41617 CVE-2023-28531 CVE-2023-51384 CVE-2023-52927 CVE-2023-53292 CVE-2024-26783 CVE-2024-27056 CVE-2024-28956 CVE-2024-36903 CVE-2024-36927 CVE-2024-42079 CVE-2024-46786 CVE-2024-47736 CVE-2024-47809 CVE-2024-49968 CVE-2024-49994 CVE-2024-49998 CVE-2024-50014 CVE-2024-50063 CVE-2024-50164 CVE-2024-50298 CVE-2024-53124 CVE-2024-53170 CVE-2024-54458 CVE-2024-56631 CVE-2024-56703 CVE-2024-56719 CVE-2024-57917 CVE-2024-57924 CVE-2024-57973 CVE-2024-57977 CVE-2024-57979 CVE-2024-58011 CVE-2024-58016 CVE-2024-58020 CVE-2024-58056 CVE-2024-58058 CVE-2024-58061 CVE-2024-58086 CVE-2025-21645 CVE-2025-21648 CVE-2025-21655 CVE-2025-21676 CVE-2025-21682 CVE-2025-21702 CVE-2025-21705 CVE-2025-21706 CVE-2025-21707 CVE-2025-21718 CVE-2025-21731 CVE-2025-21745 CVE-2025-21758 CVE-2025-21760 CVE-2025-21764 CVE-2025-21765 CVE-2025-21780 CVE-2025-21795 CVE-2025-21796 CVE-2025-21802 CVE-2025-21814 CVE-2025-21846 CVE-2025-21853 CVE-2025-21861 CVE-2025-21863 CVE-2025-21864 CVE-2025-21867 CVE-2025-21875 CVE-2025-21887 CVE-2025-21913 CVE-2025-21919 CVE-2025-21925 CVE-2025-21926 CVE-2025-21938 CVE-2025-21959 CVE-2025-21999 CVE-2025-22005 CVE-2025-22015 CVE-2025-22055 CVE-2025-22056 CVE-2025-22060 CVE-2025-22083 CVE-2025-22090 CVE-2025-22095 CVE-2025-22107 CVE-2025-22111 CVE-2025-22121 CVE-2025-23136 CVE-2025-23143 CVE-2025-37785 CVE-2025-37909 CVE-2025-37917 CVE-2025-37945 CVE-2025-37959 CVE-2025-37964 CVE-2025-37972 CVE-2025-37980 CVE-2025-38125 CVE-2025-38162 CVE-2025-38192 CVE-2025-38201 CVE-2025-38232 CVE-2025-38322 CVE-2025-38591 CVE-2025-38614 CVE-2025-38681 CVE-2025-38704 CVE-2025-38721 CVE-2025-38725 CVE-2025-38727 CVE-2025-38732 CVE-2025-38736 CVE-2025-39681 CVE-2025-39691 CVE-2025-39721 CVE-2025-39748 CVE-2025-39756 CVE-2025-39764 CVE-2025-39770 CVE-2025-39773 CVE-2025-39782 CVE-2025-39795 CVE-2025-39826 CVE-2025-39827 CVE-2025-39845 CVE-2025-39866 CVE-2025-39871 CVE-2025-39931 CVE-2025-39953 CVE-2025-39955 CVE-2025-39964 CVE-2025-39977 CVE-2025-39978 CVE-2025-39980 CVE-2025-40022 CVE-2025-40070 CVE-2025-40078 CVE-2025-40080 CVE-2025-40105 CVE-2025-40135 CVE-2025-40149 CVE-2025-40196 CVE-2025-40219 CVE-2025-40261 CVE-2025-40300 CVE-2025-61984 CVE-2025-61985 CVE-2025-68206 CVE-2025-68261 CVE-2025-68264 CVE-2025-68265 CVE-2025-68266 CVE-2025-68291 CVE-2025-68337 CVE-2025-68349 CVE-2025-68363 CVE-2025-68371 CVE-2025-68724 CVE-2025-68725 CVE-2025-68742 CVE-2025-68764 CVE-2025-68773 CVE-2025-68776 CVE-2025-68782 CVE-2025-68787 CVE-2025-68788 CVE-2025-68798 CVE-2025-68803 CVE-2025-68814 CVE-2025-68816 CVE-2025-68818 CVE-2025-68820 CVE-2025-71064 CVE-2025-71075 CVE-2025-71079 CVE-2025-71085 CVE-2025-71086 CVE-2025-71088 CVE-2025-71095 CVE-2025-71097 CVE-2025-71098 CVE-2025-71104 CVE-2025-71112 CVE-2025-71113 CVE-2025-71114 CVE-2025-71120 CVE-2025-71123 CVE-2025-71131 CVE-2025-71161 CVE-2025-71162 CVE-2025-71163 CVE-2025-71185 CVE-2025-71186 CVE-2025-71189 CVE-2025-71190 CVE-2025-71191 CVE-2025-71197 CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267 CVE-2026-3497 CVE-2026-22977 CVE-2026-22979 CVE-2026-22980 CVE-2026-22982 CVE-2026-22992 CVE-2026-22994 CVE-2026-23003 CVE-2026-23005 CVE-2026-23010 CVE-2026-23011 CVE-2026-23019 CVE-2026-23026 CVE-2026-23038 CVE-2026-23054 CVE-2026-23060 CVE-2026-23083 CVE-2026-23084 CVE-2026-23086 CVE-2026-23087 CVE-2026-23095 CVE-2026-23100 CVE-2026-23103 CVE-2026-23110 CVE-2026-23111 CVE-2026-23113 CVE-2026-23154 CVE-2026-23204 CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245 CVE-2026-23255 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273 CVE-2026-23274 CVE-2026-23277 CVE-2026-23284 CVE-2026-23287 CVE-2026-23290 CVE-2026-23293 CVE-2026-23300 CVE-2026-23304 CVE-2026-23319 CVE-2026-23321 CVE-2026-23335 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351 CVE-2026-23359 CVE-2026-23365 CVE-2026-23368 CVE-2026-23370 CVE-2026-23378 CVE-2026-23379 CVE-2026-23381 CVE-2026-23391 CVE-2026-23392 CVE-2026-23397 CVE-2026-23398 CVE-2026-23399 CVE-2026-23414 CVE-2026-23422 CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446 CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454 CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458 CVE-2026-23463 CVE-2026-23474 CVE-2026-23475 CVE-2026-27135 CVE-2026-31389 CVE-2026-31391 CVE-2026-31396 CVE-2026-31402 CVE-2026-31403 CVE-2026-31411 CVE-2026-31414 CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418 CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424 CVE-2026-31427 CVE-2026-31428 CVE-2026-31441 CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31449 CVE-2026-31450 CVE-2026-31452 CVE-2026-31466 CVE-2026-31469 CVE-2026-31485 CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507 CVE-2026-31508 CVE-2026-31515 CVE-2026-31518 CVE-2026-31521 CVE-2026-31533 CVE-2026-31546 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565 CVE-2026-31628 CVE-2026-31634 CVE-2026-31649 CVE-2026-31651 CVE-2026-31658 CVE-2026-31664 CVE-2026-31665 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671 CVE-2026-31674 CVE-2026-31680 CVE-2026-31681 CVE-2026-31682 CVE-2026-31700 CVE-2026-31737 CVE-2026-31752 CVE-2026-31761 CVE-2026-31768 CVE-2026-40355 CVE-2026-41989 CVE-2026-43011 CVE-2026-43024 CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028 CVE-2026-43030 CVE-2026-43033 CVE-2026-43035 CVE-2026-43038 CVE-2026-43040 CVE-2026-43057 CVE-2026-43071 CVE-2026-43085 CVE-2026-43089 CVE-2026-43116 CVE-2026-43216 CVE-2026-43303 CVE-2026-43492 CVE-2026-43499 CVE-2026-43501 CVE-2026-45841 CVE-2026-46015 CVE-2026-46021 CVE-2026-46033 CVE-2026-46037 CVE-2026-46040 CVE-2026-46046 CVE-2026-46086 CVE-2026-46101 CVE-2026-46116 CVE-2026-46132 CVE-2026-46172 CVE-2026-46173 CVE-2026-46174 CVE-2026-46193 CVE-2026-46303 CVE-2026-46306 CVE-2026-46323 CVE-2026-46333 CVE-2026-52910 CVE-2026-52912 CVE-2026-52930 CVE-2026-52933 CVE-2026-52942 CVE-2026-52943 CVE-2026-52946 CVE-2026-52970 CVE-2026-52986 CVE-2026-52998 CVE-2026-52999 CVE-2026-53001 CVE-2026-53002 CVE-2026-53006 CVE-2026-53012 CVE-2026-53050 CVE-2026-53134 CVE-2026-53218 CVE-2026-53219 CVE-2026-53223 CVE-2026-53236 CVE-2026-53239 CVE-2026-53249 CVE-2026-53268 CVE-2026-53269 CVE-2026-53275 CVE-2026-53295 CVE-2026-53352 CVE-2026-53400 CVE-2026-63810 CVE-2026-64279 CVE-2026-64317 CVE-2026-64370 CVE-2026-64371 CVE-2026-64375 CVE-2026-64411 CVE-2026-64412 CVE-2026-64413 CVE-2026-64422 CVE-2026-64423 CVE-2026-64425 CVE-2026-64538 CVE-2026-64545 CVE-2026-64552 CVE-2026-64560   Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for Industrial Security (https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.   Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-457936 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-457936 advisory Legal Notice and Terms of Use