150+ CVEs Hit Siemens SIMATIC S7-1500 MFP Firmware
The GNU/Linux subsystem powering the MFP's application processor has been a known attack surface since 2022; 150+ CVEs in a single firmware version suggests either a long-overdue code audit or a component that's outpacing its maintainers.
TL;DR
CISA issued an advisory identifying more than 150 vulnerabilities in the GNU/Linux subsystem of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP firmware V3.1.6. Affected sectors include chemical, critical manufacturing, energy, food and agriculture, and water and wastewater. Patches aren't available yet; Siemens recommends defense-in-depth and restricting application execution to trusted sources as interim countermeasures. The volume is unusual for a Siemens industrial product, the same subsystem drew advisories in 2022 and 2023, but this one is an order of magnitude larger.
CISA's advisory catalogs more than 150 vulnerabilities in the GNU/Linux subsystem of firmware V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP, the variant that includes a dedicated application processor running Linux alongside the real-time controller. The affected sectors read like a critical-infrastructure roll call: chemical, critical manufacturing, energy, food and agriculture, and water and wastewater. Siemens says patches are in preparation and recommends interim countermeasures for the window before fixes land.
That volume (150-plus CVEs in a single firmware version) is unusual for Siemens industrial products. The MFP's GNU/Linux subsystem isn't a new problem. CISA issued ICSA-22-104-13 in April 2022 for the same subsystem on firmware versions V2.9.3, V2.9.4, and V3.0, flagging use of unmaintained third-party components at CVSS 9.8. A subsequent advisory in December 2023 covered V3.1 with a similarly sprawling list of vulnerability types, command injection, use-after-free, buffer overflows, and dozens more. What's different this time is the scale. The earlier advisories were bad; this one is an order of magnitude larger.
What the pattern suggests
Two plausible explanations, and neither is comforting. One: Siemens finally subjected the Linux subsystem to a comprehensive audit and the result is what you'd expect from a legacy codebase that hadn't been scrutinized at that depth before. Two: the subsystem accumulates kernel-level CVEs faster than Siemens' patching cadence can absorb them, and this advisory represents a backlog rather than a single discrete finding. The advisory itself doesn't distinguish between newly discovered and previously-known-but-now-disclosed vulnerabilities, so operators can't tell which explanation applies.
What to do now
Firmware patches aren't available. Siemens' interim countermeasures (defense-in-depth, restricting application execution to trusted sources, network segmentation) are the standard playbook for ICS environments where patching windows are measured in maintenance cycles, not days. For defense contractors and critical-infrastructure operators running these controllers, the immediate step is verifying that the MFP's Linux application processor isn't reachable from untrusted networks and that any custom applications running on it have been built from trusted sources. For assessors, the question is whether a 150-CVE advisory with no patch yet constitutes a finding under whatever assessment framework governs the site, and whether the interim mitigations suffice to close it.
Published ·Deep Fathom