Siemens SIMATIC S7-1500 TM MFP

View CSAF
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
The following versions of Siemens SIMATIC S7-1500 TM MFP are affected:

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/*





CVSS
Vendor
Equipment




v3 10
Siemens
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem






377 Vulnerabilities




Access of Uninitialized Pointer, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Deadlock, Detection of Error Condition Without Action, Double Free, Expired Pointer Dereference, Heap-based Buffer Overflow, Improper Control of Resource Identifiers ('Resource Injection'), Improper Control of a Resource Through its Lifetime, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Resource Locking, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Update of Reference Count, Improper Validation of Array Index, Improper Validation of Consistency within Input, Improper Validation of Specified Index, Position, or Offset in Input, Improper Validation of Specified Quantity in Input, Improper Validation of Specified Type of Input, Incorrect Synchronization, Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound),
Loop with Unreachable Exit Condition ('Infinite Loop'), Missing Default Case in Multiple Condition Expression, Missing Initialization of Resource, Missing Lock Check, Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Multiple Locks of a Critical Resource, NULL Pointer Dereference, Operation on a Resource after Expiration or Release,
Out-of-bounds Read, Out-of-bounds Write, Plaintext Storage of a Password, Release of Invalid Pointer or Reference, Return of Wrong Status Code, Signal Handler Race Condition, Time-of-check Time-of-use (TOCTOU) Race Condition, Unchecked Return Value, Use After Free, Use of Incorrect Operator, Use of Uninitialized Resource, Write-what-where Condition




Background

Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany


Vulnerabilities
Expand All +

CVE-2023-52927
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.
Read More

1 Affected Product

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Product Status: known_affected

Remediations

MitigationLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.


MitigationOnly build and run applications from trusted sources.


None availableCurrently no fix is available


Additional Metrics
Relevant CWE: CWE-20 Improper Input Validation




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H





View CVE Details



CVE-2023-52927
CVE-2023-53292
CVE-2023-54271
CVE-2024-26982
CVE-2024-36922
CVE-2024-40945
CVE-2024-47809
CVE-2024-49998
CVE-2024-53166
CVE-2024-56647
CVE-2024-56657
CVE-2024-56719
CVE-2024-57977
CVE-2024-57979
CVE-2024-57980
CVE-2024-57981
CVE-2024-57986
CVE-2024-57993
CVE-2024-57996
CVE-2024-58002
CVE-2024-58005
CVE-2024-58009
CVE-2024-58013
CVE-2024-58014
CVE-2024-58017
CVE-2024-58020
CVE-2024-58058
CVE-2024-58061
CVE-2024-58063
CVE-2024-58068
CVE-2024-58071
CVE-2024-58072
CVE-2024-58077
CVE-2024-58079
CVE-2024-58083
CVE-2025-21682
CVE-2025-21700
CVE-2025-21702
CVE-2025-21703
CVE-2025-21704
CVE-2025-21705
CVE-2025-21706
CVE-2025-21707
CVE-2025-21708
CVE-2025-21716
CVE-2025-21719
CVE-2025-21724
CVE-2025-21725
CVE-2025-21726
CVE-2025-21727
CVE-2025-21728
CVE-2025-21731
CVE-2025-21735
CVE-2025-21738
CVE-2025-21744
CVE-2025-21745
CVE-2025-21753
CVE-2025-21756
CVE-2025-21758
CVE-2025-21760
CVE-2025-21761
CVE-2025-21762
CVE-2025-21763
CVE-2025-21764
CVE-2025-21765
CVE-2025-21766
CVE-2025-21767
CVE-2025-21776
CVE-2025-21779
CVE-2025-21787
CVE-2025-21790
CVE-2025-21791
CVE-2025-21795
CVE-2025-21796
CVE-2025-21806
CVE-2025-21814
CVE-2025-21830
CVE-2025-21832
CVE-2025-21835
CVE-2025-21838
CVE-2025-21844
CVE-2025-21846
CVE-2025-21858
CVE-2025-21859
CVE-2025-21862
CVE-2025-21863
CVE-2025-21864
CVE-2025-21865
CVE-2025-22105
CVE-2025-23131
CVE-2025-38105
CVE-2025-38162
CVE-2025-38192
CVE-2025-38250
CVE-2025-38584
CVE-2025-38704
CVE-2025-39748
CVE-2025-39863
CVE-2025-39997
CVE-2025-40135
CVE-2025-68206
CVE-2025-68239
CVE-2025-68265
CVE-2026-23066
CVE-2026-23100
CVE-2026-23113
CVE-2026-23141
CVE-2026-23154
CVE-2026-23157
CVE-2026-23204
CVE-2026-23231
CVE-2026-23245
CVE-2026-23253
CVE-2026-23255
CVE-2026-23270
CVE-2026-23271
CVE-2026-23272
CVE-2026-23273
CVE-2026-23274
CVE-2026-23277
CVE-2026-23278
CVE-2026-23279
CVE-2026-23281
CVE-2026-23290
CVE-2026-23291
CVE-2026-23292
CVE-2026-23296
CVE-2026-23300
CVE-2026-23302
CVE-2026-23303
CVE-2026-23304
CVE-2026-23310
CVE-2026-23312
CVE-2026-23315
CVE-2026-23317
CVE-2026-23318
CVE-2026-23319
CVE-2026-23321
CVE-2026-23336
CVE-2026-23339
CVE-2026-23340
CVE-2026-23343
CVE-2026-23351
CVE-2026-23352
CVE-2026-23356
CVE-2026-23357
CVE-2026-23359
CVE-2026-23364
CVE-2026-23365
CVE-2026-23367
CVE-2026-23368
CVE-2026-23370
CVE-2026-23372
CVE-2026-23378
CVE-2026-23379
CVE-2026-23381
CVE-2026-23382
CVE-2026-23388
CVE-2026-23389
CVE-2026-23391
CVE-2026-23392
CVE-2026-23395
CVE-2026-23396
CVE-2026-23397
CVE-2026-23398
CVE-2026-23399
CVE-2026-23442
CVE-2026-23444
CVE-2026-31407
CVE-2026-31449
CVE-2026-31451
CVE-2026-31488
CVE-2026-31500
CVE-2026-31532
CVE-2026-31580
CVE-2026-31583
CVE-2026-31586
CVE-2026-31611
CVE-2026-31612
CVE-2026-31613
CVE-2026-31617
CVE-2026-31622
CVE-2026-31624
CVE-2026-31625
CVE-2026-31629
CVE-2026-31630
CVE-2026-31637
CVE-2026-31642
CVE-2026-31673
CVE-2026-31676
CVE-2026-31681
CVE-2026-31685
CVE-2026-31694
CVE-2026-31696
CVE-2026-31697
CVE-2026-31698
CVE-2026-31699
CVE-2026-31700
CVE-2026-31704
CVE-2026-31705
CVE-2026-31708
CVE-2026-31709
CVE-2026-31711
CVE-2026-31712
CVE-2026-43052
CVE-2026-43071
CVE-2026-43074
CVE-2026-43080
CVE-2026-43085
CVE-2026-43089
CVE-2026-43093
CVE-2026-43094
CVE-2026-43099
CVE-2026-43110
CVE-2026-43111
CVE-2026-43112
CVE-2026-43114
CVE-2026-43116
CVE-2026-43117
CVE-2026-43303
CVE-2026-43350
CVE-2026-43421
CVE-2026-43492
CVE-2026-43493
CVE-2026-43496
CVE-2026-43499
CVE-2026-43502
CVE-2026-43503
CVE-2026-45834
CVE-2026-45835
CVE-2026-45836
CVE-2026-45838
CVE-2026-45839
CVE-2026-45840
CVE-2026-45841
CVE-2026-45842
CVE-2026-45843
CVE-2026-45844
CVE-2026-45850
CVE-2026-45991
CVE-2026-45997
CVE-2026-46003
CVE-2026-46015
CVE-2026-46018
CVE-2026-46021
CVE-2026-46022
CVE-2026-46023
CVE-2026-46026
CVE-2026-46033
CVE-2026-46037
CVE-2026-46038
CVE-2026-46040
CVE-2026-46044
CVE-2026-46046
CVE-2026-46047
CVE-2026-46050
CVE-2026-46051
CVE-2026-46056
CVE-2026-46064
CVE-2026-46065
CVE-2026-46069
CVE-2026-46070
CVE-2026-46083
CVE-2026-46086
CVE-2026-46088
CVE-2026-46092
CVE-2026-46099
CVE-2026-46101
CVE-2026-46102
CVE-2026-46107
CVE-2026-46110
CVE-2026-46113
CVE-2026-46116
CVE-2026-46120
CVE-2026-46122
CVE-2026-46124
CVE-2026-46125
CVE-2026-46128
CVE-2026-46136
CVE-2026-46137
CVE-2026-46146
CVE-2026-46149
CVE-2026-46150
CVE-2026-46151
CVE-2026-46159
CVE-2026-46161
CVE-2026-46163
CVE-2026-46165
CVE-2026-46167
CVE-2026-46168
CVE-2026-46172
CVE-2026-46173
CVE-2026-46177
CVE-2026-46180
CVE-2026-46185
CVE-2026-46187
CVE-2026-46190
CVE-2026-46191
CVE-2026-46193
CVE-2026-46195
CVE-2026-46196
CVE-2026-46209
CVE-2026-46214
CVE-2026-46227
CVE-2026-46234
CVE-2026-46243
CVE-2026-46275
CVE-2026-46294
CVE-2026-46303
CVE-2026-46304
CVE-2026-46306
CVE-2026-46307
CVE-2026-46320
CVE-2026-46321
CVE-2026-46322
CVE-2026-46323
CVE-2026-46331
CVE-2026-52909
CVE-2026-52910
CVE-2026-52917
CVE-2026-52918
CVE-2026-52923
CVE-2026-52928
CVE-2026-52929
CVE-2026-52930
CVE-2026-52942
CVE-2026-52943
CVE-2026-52946
CVE-2026-52947
CVE-2026-52948
CVE-2026-53080
CVE-2026-53131
CVE-2026-53146
CVE-2026-53147
CVE-2026-53148
CVE-2026-53149
CVE-2026-53150
CVE-2026-53167
CVE-2026-53168
CVE-2026-53177
CVE-2026-53181
CVE-2026-53183
CVE-2026-53184
CVE-2026-53192
CVE-2026-53198
CVE-2026-53208
CVE-2026-53212
CVE-2026-53218
CVE-2026-53219
CVE-2026-53221
CVE-2026-53225
CVE-2026-53227
CVE-2026-53228
CVE-2026-53236
CVE-2026-53239
CVE-2026-53242
CVE-2026-53245
CVE-2026-53249
CVE-2026-53253
CVE-2026-53254
CVE-2026-53255
CVE-2026-53256
CVE-2026-53263
CVE-2026-53264
CVE-2026-53265
CVE-2026-53268
CVE-2026-53269
CVE-2026-53275
CVE-2026-53325
CVE-2026-53337
CVE-2026-53349
CVE-2026-53350
CVE-2026-53352
CVE-2026-53356
CVE-2026-53358
CVE-2026-53362
CVE-2026-64560


Acknowledgments

Siemens ProductCERT reported these vulnerabilities to CISA.


General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer
This ICSA is a verbatim republication of Siemens ProductCERT SSA-784472 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
Revision History

Initial Release Date: 2026-10-13




Date
Revision
Summary




2026-10-13
1
Publication Date


2026-10-22
2
Initial CISA Republication of Siemens ProductCERT SSA-784472 advisory




Legal Notice and Terms of Use

https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16

2026-10-22 12:00 UTC

--- BBBS/LiR v4.10 Toy-7
* Origin: LISTS. from TCOB1 READ ONLY (2:263/1)