Five variants of Siemens' S7-1500 1518 controller have 428 listed vulnerabilities in their built-in Linux environment, and no fix exists yet.
The advisory covers the SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, the 1518F-4 variant, and the SIPLUS S7-1500 CPU 1518-4 version, across five order numbers. All run firmware V3.1.7 or later. The flaws sit in what Siemens calls the additional GNU/Linux subsystem, not in the controller's core automation code. Siemens said it is preparing fixes. The advisory's headline rating is a CVSS v3 score of 10, the top of the 0-10 scale used to grade severity.
The weakness types read like a catalog of memory-safety and concurrency bugs: use after free, classic buffer overflows, race conditions, out-of-bounds reads and writes, and plaintext password storage. The listed CVE identifiers run from 2021 through 2025, starting with CVE-2021-41617, an OpenSSH privilege escalation. A separate "additional metrics" entry gives a CVSS 3.1 score of 7.0 (High) alongside CWE-311, missing encryption of sensitive data, with a local attack vector. The advisory does not say which CVE that entry describes, so it should not be read as a rating for the whole set.
Until patches arrive, Siemens recommends two mitigations: limit access to the Linux subsystem's interactive shell to trusted personnel, and only build and run applications from trusted sources.
The advisory lists affected sectors including critical manufacturing, energy, transportation, and healthcare, with deployment worldwide. The count is the real lesson here. A PLC, the industrial computer that runs machinery, that bundles a general-purpose Linux environment inherits that environment's entire bug stream. Identifiers spanning four years in one firmware line point to a software stack that accumulates flaws faster than a single release can clear them. That is an inference from the list, not something Siemens states.
Siemens controllers are not a new target for scrutiny; Stuxnet went after them in 2010. The open question is whether Siemens ships one consolidated firmware update or fixes the subsystem in pieces.