CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production
CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.
Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.
- Advisory covers S7-200, S7-300, S7-400, S7-1200 and S7-1500 CPU variants including F-series safety controllers.
- Attackers combine public information with AI-assisted tooling like Snap7 and python-snap7 over TCP port 102.
- Operators should prove services are 'unused' via engineering configuration, representative traffic and owner confirmation before disabling.
- MAC/IP allowlisting may need enforcement at industrial firewalls because older CPUs lack PLC-side controls.
From the original article
6 min read at csoonline.com
On a conventional server, disabling an unused service is usually a routine hardening task. On a Siemens S7 controller, the supposedly unused service may carry remote I/O traffic, supply process values to an HMI or provide the maintenance team’s only path to diagnostics. Close it without checking those dependencies and the security team may cause the outage it intended to prevent.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.