# Siemens SIMATIC S7-1500 CPU family multiple vulnerabilities

Published: 2025-09-23 · Severity: high · Sectors: infrastructure, manufacturing
Canonical: https://vorant.io/reports/f62b6820-fca1-5df0-9b23-931adfc73809/siemens-simatic-s7-1500-cpu-family-multiple-vulnerabilities

> Siemens S7-1500 industrial controllers vulnerable to remote exploitation via OpenSSH, glibc, OpenSSL and curl flaws in bundled libraries.

CISA has published an advisory covering multiple vulnerabilities affecting the Siemens SIMATIC S7-1500 CPU family (models 1518-4 and 1518F-4, firmware V3.1.5 and later). The vulnerabilities are not in the Siemens code itself but in underlying system libraries bundled with the device: OpenSSH, glibc, OpenSSL, curl, libtasn1, GnuTLS, Linux kernel, MIT Kerberos, libexpat, GLib and other open-source components. Individual CVEs range from remote code execution and privilege escalation to denial-of-service and information disclosure, with CVSS v3 scores between 4.0 and 9.8. The advisory lists 43 distinct CVEs affecting these bundled libraries. Defenders operating S7-1500 controllers should treat this as a consolidated patch advisory and contact Siemens for available firmware updates addressing the affected components.

## Mentioned in this report

- Vulnerabilities: CVE-2021-41617, CVE-2023-28531, CVE-2023-38545, CVE-2023-38546, CVE-2023-44487 (KEV), CVE-2023-4527, CVE-2023-46218, CVE-2023-46219, CVE-2023-4806, CVE-2023-48795 (templated), CVE-2023-4911 (KEV), CVE-2023-51384, CVE-2023-51385, CVE-2023-52927, CVE-2023-5363, CVE-2023-6246 (templated), CVE-2023-6779, CVE-2023-6780, CVE-2024-12133, CVE-2024-12243, CVE-2024-24855, CVE-2024-26596, CVE-2024-28085, CVE-2024-2961 (weaponized), CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602, CVE-2024-34397, CVE-2024-37370, CVE-2024-37371, CVE-2024-45490, CVE-2024-45491, CVE-2024-45492, CVE-2024-50246, CVE-2024-53166, CVE-2024-57977, CVE-2024-57996, CVE-2024-6119, CVE-2024-6387 (poc)

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f62b6820-fca1-5df0-9b23-931adfc73809/siemens-simatic-s7-1500-cpu-family-multiple-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup