All CISA Advisories, EN

Siemens SIMATIC S7-1500 TM MFP

View CSAF

Summary

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.

The following versions of Siemens SIMATIC S7-1500 TM MFP are affected:

  • SIMATIC S7-1500 TM MFP – GNU/Linux subsystem vers:all/*

CVSS
Vendor
Equipment

v3 10
Siemens
SIMATIC S7-1500 TM MFP – GNU/Linux subsystem

377 Vulnerabilities

Access of Uninitialized Pointer, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Deadlock, Detection of Error Condition Without Action, Double Free, Expired Pointer Dereference, Heap-based Buffer Overflow, Improper Control of Resource Identifiers ('Resource Injection'), Improper Control of a Resource Through its Lifetime, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Resource Locking, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Update of Reference Count, Improper Validation of Array Index, Improper Validation of Consistency within Input, Improper Validation of Specified Index, Position, or Offset in Input, Improper Validation of Specified Quantity in Input, Improper Validation of Specified Type of Input, Incorrect Synchronization, Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Loop with Unreachable Exit Condition ('Infinite Loop'), Missing Default Case in Multiple Condition Expression, Missing Initialization of Resource, Missing Lock Check, Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Multiple Locks of a Critical Resource, NULL Pointer Dereference, Operation on a Resource after Expiration or Release, Out-of-bounds Read, Out-of-bounds Write, Plaintext Storage of a Password, Release of Invalid Pointer or Reference, Return of Wrong Status Code, Signal Handler Race Condition, Time-of-check Time-of-use (TOCTOU) Race Condition, Unchecked Return Value, Use After Free, Use of Incorrect Operator, Use of Uninitialized Resource, Write-what-where Condition

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities
Expand All +

CVE-2023-52927
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.
Read More

1 Affected Product

SIMATIC S7-1500 TM MFP – GNU/Linux subsystem

Product Status: known_affected

Remediations

Mitigation
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.

Mitigation
Only build and run applications from trusted sources.

None available
Currently no fix is available

Additional Metrics

Relevant CWE: CWE-20 Improper Input Validation

CVSS Version
Base Score
Base Severity
Vector String

3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View CVE Details

  • CVE-2023-52927
  • CVE-2023-53292
  • CVE-2023-54271
  • CVE-2024-26982
  • CVE-2024-36922
  • CVE-2024-40945
  • CVE-2024-47809
  • CVE-2024-49998
  • CVE-2024-53166
  • CVE-2024-56647
  • CVE-2024-56657
  • CVE-2024-56719
  • CVE-2024-57977
  • CVE-2024-57979
  • CVE-2024-57980
  • CVE-2024-57981
  • CVE-2024-57986
  • CVE-2024-57993
  • CVE-2024-57996
  • CVE-2024-58002
  • CVE-2024-58005
  • CVE-2024-58009
  • CVE-2024-58013
  • CVE-2024-58014
  • CVE-2024-58017
  • CVE-2024-58020
  • CVE-2024-58058
  • CVE-2024-58061
  • CVE-2024-58063
  • CVE-2024-58068
  • CVE-2024-58071
  • CVE-2024-58072
  • CVE-2024-58077
  • CVE-2024-58079
  • CVE-2024-58083
  • CVE-2025-21682
  • CVE-2025-21700
  • CVE-2025-21702
  • CVE-2025-21703
  • CVE-2025-21704
  • CVE-2025-21705
  • CVE-2025-21706
  • CVE-2025-21707
  • CVE-2025-21708
  • CVE-2025-21716
  • CVE-2025-21719
  • CVE-2025-21724
  • CVE-2025-21725
  • CVE-2025-21726
  • CVE-2025-21727
  • CVE-2025-21728
  • CVE-2025-21731
  • CVE-2025-21735
  • CVE-2025-21738
  • CVE-2025-21744
  • CVE-2025-21745
  • CVE-2025-21753
  • CVE-2025-21756
  • CVE-2025-21758
  • CVE-2025-21760
  • CVE-2025-21761
  • CVE-2025-21762
  • CVE-2025-21763
  • CVE-2025-21764
  • CVE-2025-21765
  • CVE-2025-21766
  • CVE-2025-21767
  • CVE-2025-21776
  • CVE-2025-21779
  • CVE-2025-21787
  • CVE-2025-21790
  • CVE-2025-21791
  • CVE-2025-21795
  • CVE-2025-21796
  • CVE-2025-21806
  • CVE-2025-21814
  • CVE-2025-21830
  • CVE-2025-21832
  • CVE-2025-21835
  • CVE-2025-21838
  • CVE-2025-21844
  • CVE-2025-21846
  • CVE-2025-21858
  • CVE-2025-21859
  • CVE-2025-21862
  • CVE-2025-21863
  • CVE-2025-21864
  • CVE-2025-21865
  • CVE-2025-22105
  • CVE-2025-23131
  • CVE-2025-38105
  • CVE

[…]
Content was trimmed to protect the source. Please visit the original article for the full text.

This article has been indexed from All CISA Advisories

Read the original article:

Siemens SIMATIC S7-1500 TM MFP