C
CISA
Guest
View CSAF
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
The following versions of Siemens SIMATIC S7-1500 TM MFP are affected:
CVE-2023-52927
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.
Read More
Product Status: known_affected
Mitigation
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
Mitigation
Only build and run applications from trusted sources.
None available
Currently no fix is available
Relevant CWE: CWE-20 Improper Input Validation
View CVE Details
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
This ICSA is a verbatim republication of Siemens ProductCERT SSA-784472 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
The following versions of Siemens SIMATIC S7-1500 TM MFP are affected:
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/*
| CVSS | Vendor | Equipment |
|---|---|---|
| v3 10 | Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
| 377 Vulnerabilities |
|---|
| Access of Uninitialized Pointer, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Deadlock, Detection of Error Condition Without Action, Double Free, Expired Pointer Dereference, Heap-based Buffer Overflow, Improper Control of Resource Identifiers ('Resource Injection'), Improper Control of a Resource Through its Lifetime, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Resource Locking, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Update of Reference Count, Improper Validation of Array Index, Improper Validation of Consistency within Input, Improper Validation of Specified Index, Position, or Offset in Input, Improper Validation of Specified Quantity in Input, Improper Validation of Specified Type of Input, Incorrect Synchronization, Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Loop with Unreachable Exit Condition ('Infinite Loop'), Missing Default Case in Multiple Condition Expression, Missing Initialization of Resource, Missing Lock Check, Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Multiple Locks of a Critical Resource, NULL Pointer Dereference, Operation on a Resource after Expiration or Release, Out-of-bounds Read, Out-of-bounds Write, Plaintext Storage of a Password, Release of Invalid Pointer or Reference, Return of Wrong Status Code, Signal Handler Race Condition, Time-of-check Time-of-use (TOCTOU) Race Condition, Unchecked Return Value, Use After Free, Use of Incorrect Operator, Use of Uninitialized Resource, Write-what-where Condition |
Background
- Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: Germany
Vulnerabilities
Expand All +CVE-2023-52927
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.
Read More
1 Affected Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Product Status: known_affected
Remediations
Mitigation
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
Mitigation
Only build and run applications from trusted sources.
None available
Currently no fix is available
Additional Metrics
Relevant CWE: CWE-20 Improper Input Validation
| CVSS Version | Base Score | Base Severity | Vector String |
|---|---|---|---|
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
View CVE Details
- CVE-2023-52927
- CVE-2023-53292
- CVE-2023-54271
- CVE-2024-26982
- CVE-2024-36922
- CVE-2024-40945
- CVE-2024-47809
- CVE-2024-49998
- CVE-2024-53166
- CVE-2024-56647
- CVE-2024-56657
- CVE-2024-56719
- CVE-2024-57977
- CVE-2024-57979
- CVE-2024-57980
- CVE-2024-57981
- CVE-2024-57986
- CVE-2024-57993
- CVE-2024-57996
- CVE-2024-58002
- CVE-2024-58005
- CVE-2024-58009
- CVE-2024-58013
- CVE-2024-58014
- CVE-2024-58017
- CVE-2024-58020
- CVE-2024-58058
- CVE-2024-58061
- CVE-2024-58063
- CVE-2024-58068
- CVE-2024-58071
- CVE-2024-58072
- CVE-2024-58077
- CVE-2024-58079
- CVE-2024-58083
- CVE-2025-21682
- CVE-2025-21700
- CVE-2025-21702
- CVE-2025-21703
- CVE-2025-21704
- CVE-2025-21705
- CVE-2025-21706
- CVE-2025-21707
- CVE-2025-21708
- CVE-2025-21716
- CVE-2025-21719
- CVE-2025-21724
- CVE-2025-21725
- CVE-2025-21726
- CVE-2025-21727
- CVE-2025-21728
- CVE-2025-21731
- CVE-2025-21735
- CVE-2025-21738
- CVE-2025-21744
- CVE-2025-21745
- CVE-2025-21753
- CVE-2025-21756
- CVE-2025-21758
- CVE-2025-21760
- CVE-2025-21761
- CVE-2025-21762
- CVE-2025-21763
- CVE-2025-21764
- CVE-2025-21765
- CVE-2025-21766
- CVE-2025-21767
- CVE-2025-21776
- CVE-2025-21779
- CVE-2025-21787
- CVE-2025-21790
- CVE-2025-21791
- CVE-2025-21795
- CVE-2025-21796
- CVE-2025-21806
- CVE-2025-21814
- CVE-2025-21830
- CVE-2025-21832
- CVE-2025-21835
- CVE-2025-21838
- CVE-2025-21844
- CVE-2025-21846
- CVE-2025-21858
- CVE-2025-21859
- CVE-2025-21862
- CVE-2025-21863
- CVE-2025-21864
- CVE-2025-21865
- CVE-2025-22105
- CVE-2025-23131
- CVE-2025-38105
- CVE-2025-38162
- CVE-2025-38192
- CVE-2025-38250
- CVE-2025-38584
- CVE-2025-38704
- CVE-2025-39748
- CVE-2025-39863
- CVE-2025-39997
- CVE-2025-40135
- CVE-2025-68206
- CVE-2025-68239
- CVE-2025-68265
- CVE-2026-23066
- CVE-2026-23100
- CVE-2026-23113
- CVE-2026-23141
- CVE-2026-23154
- CVE-2026-23157
- CVE-2026-23204
- CVE-2026-23231
- CVE-2026-23245
- CVE-2026-23253
- CVE-2026-23255
- CVE-2026-23270
- CVE-2026-23271
- CVE-2026-23272
- CVE-2026-23273
- CVE-2026-23274
- CVE-2026-23277
- CVE-2026-23278
- CVE-2026-23279
- CVE-2026-23281
- CVE-2026-23290
- CVE-2026-23291
- CVE-2026-23292
- CVE-2026-23296
- CVE-2026-23300
- CVE-2026-23302
- CVE-2026-23303
- CVE-2026-23304
- CVE-2026-23310
- CVE-2026-23312
- CVE-2026-23315
- CVE-2026-23317
- CVE-2026-23318
- CVE-2026-23319
- CVE-2026-23321
- CVE-2026-23336
- CVE-2026-23339
- CVE-2026-23340
- CVE-2026-23343
- CVE-2026-23351
- CVE-2026-23352
- CVE-2026-23356
- CVE-2026-23357
- CVE-2026-23359
- CVE-2026-23364
- CVE-2026-23365
- CVE-2026-23367
- CVE-2026-23368
- CVE-2026-23370
- CVE-2026-23372
- CVE-2026-23378
- CVE-2026-23379
- CVE-2026-23381
- CVE-2026-23382
- CVE-2026-23388
- CVE-2026-23389
- CVE-2026-23391
- CVE-2026-23392
- CVE-2026-23395
- CVE-2026-23396
- CVE-2026-23397
- CVE-2026-23398
- CVE-2026-23399
- CVE-2026-23442
- CVE-2026-23444
- CVE-2026-31407
- CVE-2026-31449
- CVE-2026-31451
- CVE-2026-31488
- CVE-2026-31500
- CVE-2026-31532
- CVE-2026-31580
- CVE-2026-31583
- CVE-2026-31586
- CVE-2026-31611
- CVE-2026-31612
- CVE-2026-31613
- CVE-2026-31617
- CVE-2026-31622
- CVE-2026-31624
- CVE-2026-31625
- CVE-2026-31629
- CVE-2026-31630
- CVE-2026-31637
- CVE-2026-31642
- CVE-2026-31673
- CVE-2026-31676
- CVE-2026-31681
- CVE-2026-31685
- CVE-2026-31694
- CVE-2026-31696
- CVE-2026-31697
- CVE-2026-31698
- CVE-2026-31699
- CVE-2026-31700
- CVE-2026-31704
- CVE-2026-31705
- CVE-2026-31708
- CVE-2026-31709
- CVE-2026-31711
- CVE-2026-31712
- CVE-2026-43052
- CVE-2026-43071
- CVE-2026-43074
- CVE-2026-43080
- CVE-2026-43085
- CVE-2026-43089
- CVE-2026-43093
- CVE-2026-43094
- CVE-2026-43099
- CVE-2026-43110
- CVE-2026-43111
- CVE-2026-43112
- CVE-2026-43114
- CVE-2026-43116
- CVE-2026-43117
- CVE-2026-43303
- CVE-2026-43350
- CVE-2026-43421
- CVE-2026-43492
- CVE-2026-43493
- CVE-2026-43496
- CVE-2026-43499
- CVE-2026-43502
- CVE-2026-43503
- CVE-2026-45834
- CVE-2026-45835
- CVE-2026-45836
- CVE-2026-45838
- CVE-2026-45839
- CVE-2026-45840
- CVE-2026-45841
- CVE-2026-45842
- CVE-2026-45843
- CVE-2026-45844
- CVE-2026-45850
- CVE-2026-45991
- CVE-2026-45997
- CVE-2026-46003
- CVE-2026-46015
- CVE-2026-46018
- CVE-2026-46021
- CVE-2026-46022
- CVE-2026-46023
- CVE-2026-46026
- CVE-2026-46033
- CVE-2026-46037
- CVE-2026-46038
- CVE-2026-46040
- CVE-2026-46044
- CVE-2026-46046
- CVE-2026-46047
- CVE-2026-46050
- CVE-2026-46051
- CVE-2026-46056
- CVE-2026-46064
- CVE-2026-46065
- CVE-2026-46069
- CVE-2026-46070
- CVE-2026-46083
- CVE-2026-46086
- CVE-2026-46088
- CVE-2026-46092
- CVE-2026-46099
- CVE-2026-46101
- CVE-2026-46102
- CVE-2026-46107
- CVE-2026-46110
- CVE-2026-46113
- CVE-2026-46116
- CVE-2026-46120
- CVE-2026-46122
- CVE-2026-46124
- CVE-2026-46125
- CVE-2026-46128
- CVE-2026-46136
- CVE-2026-46137
- CVE-2026-46146
- CVE-2026-46149
- CVE-2026-46150
- CVE-2026-46151
- CVE-2026-46159
- CVE-2026-46161
- CVE-2026-46163
- CVE-2026-46165
- CVE-2026-46167
- CVE-2026-46168
- CVE-2026-46172
- CVE-2026-46173
- CVE-2026-46177
- CVE-2026-46180
- CVE-2026-46185
- CVE-2026-46187
- CVE-2026-46190
- CVE-2026-46191
- CVE-2026-46193
- CVE-2026-46195
- CVE-2026-46196
- CVE-2026-46209
- CVE-2026-46214
- CVE-2026-46227
- CVE-2026-46234
- CVE-2026-46243
- CVE-2026-46275
- CVE-2026-46294
- CVE-2026-46303
- CVE-2026-46304
- CVE-2026-46306
- CVE-2026-46307
- CVE-2026-46320
- CVE-2026-46321
- CVE-2026-46322
- CVE-2026-46323
- CVE-2026-46331
- CVE-2026-52909
- CVE-2026-52910
- CVE-2026-52917
- CVE-2026-52918
- CVE-2026-52923
- CVE-2026-52928
- CVE-2026-52929
- CVE-2026-52930
- CVE-2026-52942
- CVE-2026-52943
- CVE-2026-52946
- CVE-2026-52947
- CVE-2026-52948
- CVE-2026-53080
- CVE-2026-53131
- CVE-2026-53146
- CVE-2026-53147
- CVE-2026-53148
- CVE-2026-53149
- CVE-2026-53150
- CVE-2026-53167
- CVE-2026-53168
- CVE-2026-53177
- CVE-2026-53181
- CVE-2026-53183
- CVE-2026-53184
- CVE-2026-53192
- CVE-2026-53198
- CVE-2026-53208
- CVE-2026-53212
- CVE-2026-53218
- CVE-2026-53219
- CVE-2026-53221
- CVE-2026-53225
- CVE-2026-53227
- CVE-2026-53228
- CVE-2026-53236
- CVE-2026-53239
- CVE-2026-53242
- CVE-2026-53245
- CVE-2026-53249
- CVE-2026-53253
- CVE-2026-53254
- CVE-2026-53255
- CVE-2026-53256
- CVE-2026-53263
- CVE-2026-53264
- CVE-2026-53265
- CVE-2026-53268
- CVE-2026-53269
- CVE-2026-53275
- CVE-2026-53325
- CVE-2026-53337
- CVE-2026-53349
- CVE-2026-53350
- CVE-2026-53352
- CVE-2026-53356
- CVE-2026-53358
- CVE-2026-53362
- CVE-2026-64560
Acknowledgments
- Siemens ProductCERT reported these vulnerabilities to CISA.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
- Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
- Locate control system networks and remote devices behind firewalls and isolating them from business networks.
- When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Advisory Conversion Disclaimer
This ICSA is a verbatim republication of Siemens ProductCERT SSA-784472 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
Revision History
- Initial Release Date: 2026-10-13
| Date | Revision | Summary |
|---|---|---|
| 2026-10-13 | 1 | Publication Date |
| 2026-10-22 | 2 | Initial CISA Republication of Siemens ProductCERT SSA-784472 advisory |