SIMATIC S7-PLCSIM Advanced DoS flaw has no patch
All versions are vulnerable to unauthenticated local-network attackers; with no fix available, administrators must choose among three manual mitigations to prevent application crashes that require a manual restart.
TL;DR
CISA republished a Siemens advisory for CVE-2026-54429, a high-severity (CVSS 7.4) denial-of-service vulnerability affecting all versions of SIMATIC S7-PLCSIM Advanced. An unauthenticated attacker on the local network segment can exhaust application memory via high-volume multicast traffic, crashing the application; a manual restart is required but no project data is lost. No patch is available. Siemens recommends three mitigations: disable Virtual Switch binding on the network adapter, restrict multicast traffic on the host segment, or use Softbus/PLCSIM mode, which does not accept external packets.
The vulnerability sits in how S7-PLCSIM Advanced handles multicast traffic. When an attacker on the local network segment sends high-volume multicast packets (and a specific project configuration is active on the target) the application fails to throttle memory allocation, eventually exhausting available resources and crashing. Recovery requires a manual restart. Project data survives the crash, but the simulation session doesn't.
Siemens isn't offering a patch yet. The advisory lists three countermeasures, each targeting a different layer. The most definitive is switching to Softbus or PLCSIM network mode, which is the default and accepts no external packets at all, removing the attack surface entirely. Disabling the S7-PLCSIM Virtual Switch binding on the network adapter achieves a similar result by preventing the instance from entering external communication mode. Restricting multicast traffic on the host segment is less targeted but may be necessary when the other two aren't feasible for a given workflow.
CISA classifies this under Critical Manufacturing, and the advisory notes worldwide deployment. For organizations using S7-PLCSIM Advanced to validate control logic before deployment (including defense contractors and assessors working through test environments) the absence of a patch means the mitigation isn't a stopgap. It's the remediation. Siemens hasn't indicated when fix versions will land or whether they'll cover all affected releases.
Published ·Deep Fathom