Siemens SIMATIC S7-PLCSIM Advanced: 1 CVE, High 7.4
Summary
CISA reports 1 vulnerability in Siemens SIMATIC S7-PLCSIM Advanced. Weakness type: Allocation of Resources Without Limits or Throttling. SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. Highest CVSS v3 score: 7.4 (High), exploitable from an adjacent network.
At a glance
- Vendor
- Siemens
- Products
- SIMATIC S7-PLCSIM Advanced
- CVEs
- CVE-2026-54429
- Highest CVSS v3
- 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-54429 | Allocation of Resources Without Limits or Throttling | 7.4 | – | No | CVE-2026-54429 |
Affected products (1)
- SIMATIC S7-PLCSIM Advanced
Vendor fixes and mitigations (from advisory)
- Mitigation: Disable the S7-PLCSIM Virtual Switch binding on the network adapter used by the affected instance. This prevents the adapter from entering an external communication mode and removes the attack vector entirely. (see SIMATIC S7-PLCSIM Advanced Function Manual V8.0, 11/2025 Section 5.3 and Section 6.1.2.3; and SIMATIC S7-PLCSIM Advanced Function Manual API V8.0, 11/2025 Section 7.2)
- Mitigation: Restrict multicast traffic on the network segment hosting the SIMATIC S7-PLCSIM Advanced host.
- Mitigation: Use 'Softbus' / 'PLCSIM' network mode. This mode does not accept any packets from the network. This mode is a default network mode. (see SIMATIC S7-PLCSIM Advanced Function Manual V8.0, 11/2025 Section 5.0 and Section 5.1; and SIMATIC S7-PLCSIM Advanced Function Manual API V8.0, 11/2025 Section 7.2)
- None Available: Currently no fix is available
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-209-03
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-828211.json
- https://cert-portal.siemens.com/productcert/html/ssa-828211.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.