Siemens S7-1500 CPU Linux Subsystem Riddled With CVEs
Siemens disclosed hundreds of vulnerabilities in the GNU/Linux subsystem of SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP firmware, with fixes still pending for many.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 36 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA and Siemens published an ICS advisory covering the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (including SIPLUS variants), identifying an extremely large number of vulnerabilities—several hundred CVEs—in the additional GNU/Linux subsystem bundled with firmware version V3.1.6 and later. The vast majority of these CVEs stem from upstream Linux kernel and open-source component issues (memory corruption, use-after-free, out-of-bounds access, privilege escalation, etc.) that have accumulated over multiple years of kernel releases, rather than vulnerabilities unique to Siemens' own code.
One specifically called-out issue, CVE-2021-41617, involves an OpenSSH privilege escalation flaw where supplemental groups are not properly initialized when AuthorizedKeysCommand or AuthorizedPrincipalsCommand helper programs are configured to run as a different user, potentially granting those helpers unintended group privileges. Siemens states that fix versions are still being prepared for many of the affected CVEs and is recommending interim countermeasures (network segmentation, restricting access to the Linux subsystem, and following general ICS hardening guidance) until patches are released.
The affected products are deployed worldwide in critical manufacturing environments. There is no indication in the advisory of active exploitation in the wild; this is a vendor-driven vulnerability disclosure requiring asset owners to inventory affected CPU models, monitor for Siemens patch releases, and apply the recommended mitigations in the interim.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs