Advisories › Siemens › ICSA-26-265-04
Siemens SIPLUS and SIMATIC Products: 1 CVE, High 7.8
Summary
CISA reports 1 vulnerability in Siemens SIMATIC AX Runtime Core Linux Common Debian, SIMATIC AX Runtime Core Linux Common Debian arm64, SIMATIC AX Runtime Core Linux Platform Container Common Debian Development, SIMATIC AX Runtime Core Linux VMWare Development and 63 more. Weakness type: Incorrect Resource Transfer Between Spheres. Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector. At least one CVE is on CISA's Known Exploited Vulnerabilities list.
What to do: Act now: Update to V21 Update 2 SR1 or later version
Why this matters for oil & gas: Siemens (SIMATIC S7, PCS 7, WinCC, RUGGEDCOM) is widely used in process plants and pipelines; Affected products include SIMATIC S7.
At a glance
- Vendor
- Siemens
- Products
- SIMATIC AX Runtime Core Linux Common Debian, SIMATIC AX Runtime Core Linux Common Debian arm64, SIMATIC AX Runtime Core Linux Platform Container Common Debian Development, SIMATIC AX Runtime Core Linux VMWare Development, SIMATIC CN 4100, SIMATIC HMI MTP1000 Unified Basic (6AV2123-3KB32-0AW0), SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1), SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0)
- CVEs
- CVE-2026-31431
- Highest CVSS v3
- 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- Yes
- Sectors (per CISA)
- Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, Commercial Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-31431 | Incorrect Resource Transfer Between Spheres | 7.8 | – | Yes (added 2026-05-01) | CVE-2026-31431 |
Affected products (67)
- SIMATIC AX Runtime Core Linux Common Debian
- SIMATIC AX Runtime Core Linux Common Debian arm64
- SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
- SIMATIC AX Runtime Core Linux VMWare Development
- SIMATIC CN 4100 < V6.0
- SIMATIC HMI MTP1000 Unified Basic (6AV2123-3KB32-0AW0) < V21.2.1
- SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) < V21.2.1
- SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) < V21.2.1
- SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) < V21.2.1
- SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1) < V21.2.1
- SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) < V21.2.1
- SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) < V21.2.1
- SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) < V21.2.1
- SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0) < V21.2.1
- SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0) < V21.2.1
- SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0) < V21.2.1
- SIMATIC HMI MTP1200 Unified Basic (6AV2123-3MB32-0AW0) < V21.2.1
- SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1) < V21.2.1
- SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0) < V21.2.1
- SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0) < V21.2.1
- SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1) < V21.2.1
- SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0) < V21.2.1
- SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0) < V21.2.1
- SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0) < V21.2.1
- SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0) < V21.2.1
- SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0) < V21.2.1
- SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0) < V21.2.1
- SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1) < V21.2.1
- SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0) < V21.2.1
- SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0) < V21.2.1
- SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1) < V21.2.1
- SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0) < V21.2.1
- SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0) < V21.2.1
- SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0) < V21.2.1
- SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0) < V21.2.1
- SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0) < V21.2.1
- SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0) < V21.2.1
- SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1) < V21.2.1
- SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0) < V21.2.1
- SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0) < V21.2.1
Show 27 more
- SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1) < V21.2.1
- SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0) < V21.2.1
- SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0) < V21.2.1
- SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0) < V21.2.1
- SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0) < V21.2.1
- SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0) < V21.2.1
- SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0) < V21.2.1
- SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0) < V21.2.1
- SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0) < V21.2.1
- SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1) < V21.2.1
- SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1) < V21.2.1
- SIMATIC HMI MTP400 Unified Basic (6AV2123-3DB32-0AW0) < V21.2.1
- SIMATIC HMI MTP700 Unified Basic (6AV2123-3GB32-0AW0) < V21.2.1
- SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1) < V21.2.1
- SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0) < V21.2.1
- SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0) < V21.2.1
- SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1) < V21.2.1
- SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)
- SIMATIC IPC Industrial Edge Device OS (IED-OS)
- SIMATIC S7-1500 TM MFP (6ES7558-1AA00-0AB0)
- SIPLUS HMI MTP1000 Unified Basic (6AG1123-3KB32-2AW0) < V21.2.1
- SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1) < V21.2.1
- SIPLUS HMI MTP1200 Unified Basic (6AG1123-3MB32-2AW0) < V21.2.1
- SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1) < V21.2.1
- SIPLUS HMI MTP400 Unified Basic (6AG1123-3DB32-2AW0) < V21.2.1
- SIPLUS HMI MTP700 Unified Basic (6AG1123-3GB32-2AW0) < V21.2.1
- SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1) < V21.2.1
Vendor fixes and mitigations (from advisory)
- Mitigation: Limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.
- Mitigation: Only build and run applications from trusted sources.
- None Available: Currently no fix is available
- Vendor Fix: Update to V21 Update 2 SR1 or later version link
- Vendor Fix: Update to V21 SP2 Update 1 or later version TODO: download link missing
- Vendor Fix: Update to V6.0 or later version link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-265-04
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-328642.json
- https://cert-portal.siemens.com/productcert/html/ssa-328642.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.