MDR
Solutions
Partners
About
Resources
Affected Environment
Siemens industrial and building automation products, including SIMATIC S7-1500 CPUs and S7 PLC web servers, SIMATIC WinCC, SIMATIC IPCs and HMI panels, Industrial Edge, RUGGEDCOM APE1808 and CROSSBOW, SIPLUS, PSS(R)SINCAL, SENTRON, APOGEE, TALON and Desigo controllers, Capital Embedded AR Classic and Software Center. The report also covers the third-party Kiloview E3 NDI encoder and InterSystems IRIS for Health.
Threat Overview
Multiple advisories covering unauthorised access, privilege escalation, denial of service, information disclosure and arbitrary code execution. The highest scores are Kiloview E3 CVE-2026-107861 and CVE-2026-110243 (CVSS 9.9), RUGGEDCOM CROSSBOW SQLite flaw CVE-2025-71316 (9.8), S7 PLC web server CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354 (9.6), and Industrial Edge CVE-2026-44415 (9.1).
Exposure Timeline
Report issued 23 October 2026, drawing on CISA ICS advisories ICSA-26-295-01 to ICSA-26-295-18. Fixed versions exist for some products; others have no fix available or planned.
Attack Surface
S7 PLC web server trace page, RUGGEDCOM APE1808 (Nozomi Guardian/CMC) dashboards and credential manager, CROSSBOW web and database functions, the GNU/Linux subsystem on S7-1500 MFP CPUs, Industrial Edge APIs, FTP and web services on APOGEE, TALON and Desigo controllers, Kiloview ONVIF and web management, the WibuKey driver in PSS(R)SINCAL, and UEFI Secure Boot on SIMATIC IPCs.
Technical Root Cause
Improper input validation and sanitisation (SQL injection, template injection, cross-site scripting, OS command injection), missing authorisation checks, missing certificate validation, outdated third-party components (OpenSSH, Linux kernel, SQLite) and a BIOS vendor test key in the UEFI Secure Boot database.
Exploitation Pathway
Most flaws need authentication. The S7 web server flaws require a user holding the 'Read diagnostics' right to be socially engineered into importing a crafted trace file. APOGEE, TALON and Desigo flaws and several Kiloview ONVIF flaws can be exploited by unauthenticated remote attackers. The SIMATIC IPC Secure Boot bypass needs local physical or administrative access.
Operational Impact
Arbitrary code or OS command execution (as root on Kiloview E3), SQL command execution on the CROSSBOW database, credential exposure, PLC operations through a victim's browser session, device crashes and denial of service, and bypass of UEFI Secure Boot.
Strategic Impact
The source report does not rate risk by entity size. Several products have no fix available or planned, so operators of those products depend on compensating controls.
Required Mitigation
Update where a fixed version exists:
No fix available or planned for: SIMATIC S7-1500 CPU 1518 MFP and TM MFP (CVE-2021-41617, CVE-2023-52927), the Industrial Edge-related flaws on SCALANCE LPE9413 and LPE9433 and SIMATIC HMI MTP series panels, and Capital Embedded AR Classic 431-422. The source lists no fixed version for the S7-1500 and ET 200SP web server flaws (CVE-2026-63350 to CVE-2026-63357) or the APOGEE and TALON controllers.
Where no fix exists, Siemens advises limiting access to the interactive shell of the GNU/Linux subsystem to trusted personnel and running applications only from trusted sources. For APOGEE, TALON and Desigo controllers, apply network segmentation, place controllers behind properly configured gateways or firewalls, and disable the FTP and web services (disabled by default). For InterSystems IRIS for Health, InterSystems recommends setting the superserver to require SSL/TLS.
Incident Response Guidance
The source report provides mitigations only. Compare the asset inventory against the product lists above, prioritise products with no fix, and review who can reach affected management interfaces and web servers.
References
CISA ICS advisories ICSA-26-295-01 to ICSA-26-295-18 (cisa.gov/news-events/ics-advisories).
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)