# Siemens S7-1500 PLC exposes 428 Linux flaws

Published: 2026-10-22 · Severity: elevated · Sectors: Manufacturing, Transportation, Energy, Healthcare, Financial Services, Government (National)
Canonical: https://vorant.io/reports/f447ce3e-6134-51bb-9992-54a80080a110/siemens-s7-1500-plc-exposes-428-linux-flaws

> Siemens' SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP firmware bundles a Linux subsystem carrying 428 known vulnerabilities, with no exploitation reported yet.

Siemens ProductCERT, via CISA ICSA-26-295-11, disclosed that firmware version V3.1.7 and later on the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (including the SIPLUS variant) ships an additional GNU/Linux subsystem that inherits 428 previously identified vulnerabilities from upstream open-source components, primarily the Linux kernel. The advisory lists CVEs spanning 2021 through 2026, with weakness classes including buffer overflows, use-after-free, out-of-bounds read/write, race conditions, improper privilege management, NULL pointer dereference, and information disclosure via transient execution (side-channel) flaws. One vulnerability carries a CVSS v3 base score of 10. Affected products are the 6ES7518-4AX00-1AB0/1AC0, 6ES7518-4FX00-1AB0/1AC0 CPU models and the SIPLUS 6AG1518-4AX00-4AC0 variant.

Siemens states fixes are being prepared and recommends standard ICS hardening in the interim: minimizing network exposure, isolating control system networks behind firewalls, and using VPNs for remote access while acknowledging VPN endpoints themselves require patching. No evidence of in-the-wild exploitation against this specific product is cited in the advisory; the entries represent inherited third-party component vulnerabilities rather than a newly discovered Siemens-specific flaw or active campaign.

Defenders operating these PLCs in critical manufacturing, energy, transportation, healthcare, financial services, or government facility environments should inventory affected firmware/hardware versions, apply Siemens patches once released, and in the meantime ensure these devices are not internet-facing and sit behind segmented, monitored network boundaries per Siemens' and CISA's operational guidance.

## Mentioned in this report

- Vulnerabilities: CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2023-53292, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f447ce3e-6134-51bb-9992-54a80080a110/siemens-s7-1500-plc-exposes-428-linux-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup