Siemens flags hundreds of Linux flaws in its S7-1500 MFP factory controllers
The firmware inside a widely used industrial controller ships with a Linux subsystem carrying more than 300 unpatched CVEs. Siemens says a fix is coming.
Key points
- Siemens has disclosed hundreds of vulnerabilities in the Linux subsystem bundled with firmware version 3.1.6 of its SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP industrial controllers.
- Two hardware variants are affected: part numbers 6ES7518-4AX00-1AB0 and 6ES7518-4AX00-1AC0, plus the ruggedised SIPLUS versions.
- CVEs span from CVE-2021-41617 in OpenSSH through kernel and userspace bugs dated as late as 2026.
- Siemens says fixed firmware is in preparation and is recommending interim mitigations.
- The controllers run factory floors, water plants and energy infrastructure, where an outage has real-world consequences.
Siemens has published a security advisory admitting that firmware version 3.1.6 of its SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP, a high-end industrial controller used to run factory lines and plant equipment, ships with a Linux operating system carrying more than three hundred known security flaws.
The MFP in the product name stands for Multifunctional Platform. It's a programmable logic controller (a small industrial computer that controls valves, motors and production lines) with a second Linux environment tacked on so customers can run their own applications alongside the control logic.
That Linux side is where the problem lives.
What is actually broken?
The Linux distribution baked into the firmware is old, and it carries every publicly known bug that comes with being old. Siemens lists CVEs (unique identifiers for individual software flaws) stretching from 2021 to 2026, including a long-standing information leak in OpenSSH tracked as CVE-2021-41617 and a large batch of Linux kernel issues from the 2024 and 2025 stable trees.
Most of these aren't novel zero-days. They're the routine drip of kernel, sshd and glibc fixes that a normal server picks up through weekly package updates. A PLC firmware image doesn't get weekly updates. It gets one image, signed and tested, shipped, and then it sits on a factory floor for years.
The failure mode is the industrial patch cycle colliding with the general-purpose Linux patch cycle. They're not compatible. We've watched this pattern repeat across four Siemens advisories since early July, including the RUGGEDCOM SINEC OS disclosure on 7 July and the broader multi-vendor industrial patch wave on 15 July.
Who runs these things?
The 1518 MFP is a top-of-range Siemens controller. You find it in car plants, pharmaceutical lines and utilities. The SIPLUS variants listed in the advisory are hardened versions built for harsh conditions such as extreme cold or vibration, typically deployed in outdoor infrastructure. Real production, not lab gear.
Can an attacker actually reach it?
That depends entirely on how the site is wired. A controller sitting on a properly segmented operational network, with no direct internet exposure and strict access controls on the engineering workstation, is a hard target regardless of what CVEs its Linux side carries. A controller reachable from the corporate IT network, or worse from the internet through a misconfigured remote-access box, is a soft one.
Most of the listed flaws require local access or an authenticated foothold to exploit. One magic remote code execution bug isn't the concern. The concern is that once an attacker gets any position on that Linux subsystem, they have a shopping list of privilege escalations and kernel bugs to choose from.
Should you worry about the patch timeline?
Siemens hasn't given a date. That's uncomfortable when the CVE list runs past three hundred entries and includes bugs filed against 2026 kernel trees.
| Item | Detail |
|---|---|
| Affected firmware | V3.1.6 and later on 1518(F)-4 PN/DP MFP |
| Affected part numbers | 6ES7518-4AX00-1AB0, 6ES7518-4AX00-1AC0, SIPLUS variants |
| Fixed version | In preparation, no date yet |
| Interim advice | Network segmentation, restrict access to trusted engineering stations |
| CVE count | 300+ across Linux kernel, OpenSSH, glibc and userspace |
Siemens is telling customers to follow its standard operational guidelines: put controllers behind a firewall, restrict who can talk to them, allow only the engineering tools that need access. Same advice, every advisory, for years. It works when it's actually implemented.
Whenever the first real incident lands on one of these boxes, the post-mortem will note that the CVEs were public for years and the controller was reachable from a network it had no business being on.
If you run 1518 MFPs, treat the Linux subsystem as untrusted until the fixed firmware ships and audit exactly who and what can currently open a socket to it.
