Full Report
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in SIMATIC S7-1500 CPU 1518 MFP GNU/Linux Subsystem
## CVE Details
This advisory covers a large set of vulnerabilities (45+ listed) affecting the integrated Linux environment. Key examples include:
- **CVE-2025-39953**: CVSS 9.8 (Critical) - Potential hung task/DoS in cgroup destruction.
- **CVE-2025-39871**: CVSS 5.5 (Medium) - CWE-416: Use After Free in dmaengine.
- **CVE-2025-39931**: CVSS 5.5 (Medium) - CWE-457: Use of Uninitialized Variable in crypto af_alg.
- **Aggregate Score**: CVSS v3.1 Base Score: **9.8 (Critical)** | CVSS v4.0 Base Score: **8.7 (High)**.
## Affected Systems
- **Products**:
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
- Includes related ET 200 CPUs and SIPLUS variants.
- **Versions**: All firmware versions **>= V3.1.6**.
- **Configurations**: Systems utilizing the "additional GNU/Linux subsystem" feature of the Multi-Functional Platform (MFP) CPUs.
## Vulnerability Description
The vulnerabilities reside within the **GNU/Linux subsystem** (the C/C++ runtime environment) of the S7-1500 MFP firmware. Because this subsystem runs alongside the PLC runtime, flaws in the Linux kernel or core libraries can impact the stability and security of the entire module.
- **Technical Flaws**: Identified issues include reference count underflows (Use-After-Free) in DMA engine drivers, uninitialized variables in cryptographic messaging (af_alg), and race conditions/deadlocks in cgroup management.
## Exploitation
- **Status**: Not currently reported as exploited in the wild; no public PoC specifically for the S7-1500 implementation is noted, though generic Linux kernel PoCs may exist for individual CVEs.
- **Complexity**: Varies (Low to High depending on the specific CVE).
- **Attack Vector**: Primarily **Network** (given the 9.8 CVSS rating), though some kernel flaws require **Local** access within the Linux subsystem.
## Impact
- **Confidentiality**: High (Possible data exfiltration from the Linux environment).
- **Integrity**: High (Potential for unauthorized modification of the subsystem).
- **Availability**: High (Risk of kernel panics, hung tasks, and PLC communication disruption).
## Remediation
### Patches
Siemens is currently **preparing fix versions**. No firmware patch is available as of the publication date (2026-07-14).
### Workarounds
- **Restrict Access**: Limit access to the GNU/Linux subsystem to trusted users and applications only.
- **Network Segmentation**: Isolate the PN/DP interfaces of the MFP CPU from untrusted networks using firewalls.
- **Disable Subsystem**: If the Linux functionality is not required for the specific automation task, ensure it is not configured or utilized.
## Detection
- **Indicators of Compromise**: Unexpected reboots of the CPU, loss of communication with the Linux subsystem, or unusual resource consumption (CPU/RAM) within the Linux environment.
- **Methods**: Monitor system logs via the Siemens TIA Portal or internal Linux logging if accessible. Use industrial IDS to monitor for unusual traffic to the MFP's specialized ports.
## References
- **Vendor Advisory**: hxxps://cert-portal.siemens.com/productcert/pdf/ssa-019113.pdf
- **Siemens ProductCERT**: hxxps://cert-portal.siemens.com/productcert/html/ssa-019113.html