Siemens flags 428 flaws in a factory controller that still has no fix

Key points

• Siemens disclosed 428 separate vulnerabilities in the Linux subsystem of its SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP controllers running firmware V3.1.7, and no patch is available yet.
• Five product variants are affected, including the ruggedised SIPLUS model used in harsher industrial sites.
• The controllers are deployed worldwide across critical manufacturing, energy, transport, healthcare, financial services and government facilities.
• Siemens' only current advice is to restrict shell access to trusted staff and only run software from trusted sources.
• One listed Linux kernel bug, CVE-2025-39964, already appears on the US government's Known Exploited Vulnerabilities list.

Siemens has told customers that a specific line of its factory-floor controllers is carrying 428 known software flaws, with no fix ready and only workarounds on offer.

The advisory, published through CISA, covers the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP range running firmware version V3.1.7. These are programmable logic controllers, the small industrial computers that run physical equipment such as production lines and power switchgear. The "MFP" variants are unusual because they ship with an additional GNU/Linux subsystem alongside the normal control logic, so plant engineers can run their own C or C++ code on the device.

That Linux side is where every one of the 428 bugs lives.

How bad is this, really?

It's bad on paper and awkward in practice. The device itself isn't exposed to the open internet in a sensible deployment, but the sheer number of unpatched flaws means any attacker who reaches the plant network has a long menu to pick from.

The list reads like a catalogue of memory safety failures: buffer overflows, use-after-free bugs, race conditions, null pointer dereferences, integer overflows, type confusion and plaintext password storage. Several are old and well understood. CVE-2021-41617, an OpenSSH privilege escalation from 2021, is there. So is CVE-2023-28531, which lets smartcard keys be added to an SSH agent without the destination limits the user asked for, and CVE-2023-51384, a related ssh-agent weakness from the same era.

The entry that should move first is CVE-2025-39964, a Linux kernel race condition that CISA has already flagged as actively exploited. We covered CISA's order to federal agencies on that Linux kernel addition in our 18 September story.

What are the affected products?

Five models are listed, all on firmware V3.1.7 or later.

Siemens, headquartered in Germany, says it's "preparing fixes" but gives no date. For every variant the mitigation text is identical: limit interactive shell access on the Linux subsystem to trusted personnel, and build and run applications only from trusted sources.

What should operators do now?

Treat the Linux side of these controllers as untrusted until a firmware update arrives. That means tight network segmentation between the plant network and anything carrying office traffic or remote-access tooling, logging of any SSH use into the MFP subsystem, and a short written list of who is allowed to push code to it. Our 17 September guide on securing Siemens PLCs without causing outages covers the segmentation steps in detail.

A 428-CVE advisory isn't really 428 new discoveries. It's the backlog of upstream Linux and OpenSSH fixes that haven't yet made it into a shipped firmware image for this controller family, a common pattern in industrial kit where release cycles run in years rather than weeks. The question worth asking Siemens isn't how 428 bugs got in. It's when the next firmware drops and which of them it actually closes.