Quick answer. Siemens PLC vulnerabilities are read in the ProductCERT advisory, for four things: which article numbers and versions are affected, how severe it is and what access an attacker needs, whether a fix exists, and what Siemens recommends in the meantime. Then decide on three: who can reach the CPU, what it costs to stop the machine, and when the next planned outage is. For SSA-482757, which needs physical access and has no planned fix for any affected article number, the usual answer is a locked cabinet today and a CPU swap at the next outage.
This article takes one real, public advisory, SSA-482757 on S7-1500 CPUs, and reads it line by line the way you would if you had to make the call on a machine that is running production. It makes no claims about other advisories: the method carries over, the content does not. It belongs to the practical PLC cybersecurity guide for machine programmers.
In particolar modo vedremo:
Where Siemens advisories live
The authoritative source is Siemens ProductCERT, which publishes its advisories on the Siemens cert-portal under an SSA number. You can also follow them as CSAF or RSS from the siemens.com/cert page.
The CISA page is not enough. CISA says so itself: «As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory» (ICSA-25-294-03). There is a CISA advisory for SSA-482757 from January 2023, ICSA-23-012-08. It is a snapshot of January 2023. The Siemens advisory has been revised five times since.
NIST SP 800-82 Rev. 3 gives a practical reason as well: «not all vendors report known vulnerabilities to CISA», so subscribe to the vendor’s notifications on top of CISA alerts.
SSA-482757, line by line
The header: version and date first
The top of the text file carries the publication date (2023-01-10), the last update (2025-01-14), the current version (1.5) and the CVSS v3.1 base score (4.6). Write the version down before anything else. Six months from now someone will ask what the decision was based on, and the answer should be «SSA-482757 version 1.5 of 14 January 2025», not «the Siemens advisory».
At the bottom of the file there is a revision history (History Data). It shows that every revision from 1.1 to 1.5 added new hardware versions. That is the list anyone buying a spare cares about.
Caveat. We read version 1.5. The advisory may have been updated since: before deciding anything on a plant, re-read it on the ProductCERT portal and compare the version number.
What the vulnerability is, and what access it needs
The summary reads: «Affected models of the S7-1500 CPU product family do not contain an Immutable Root of Trust in Hardware… An attacker with physical access to the device could use this to replace the boot image of the device and execute arbitrary code.»
The words that drive the decision are «with physical access». Someone has to be standing at the CPU. Read the 4.6 score together with that attack vector. On its own it is a number; next to «physical access» it becomes a specific question about your plant: who can open the cabinet?
Products and versions: the article number is what counts
The Affected Products and Solution section lists CPUs by name and article number. The product name is not enough: «CPU 1510SP-1 PN» is the name of affected article numbers and of a new hardware version that does not have the flaw. In version 1.5 every affected article number carries «Currently no fix is planned». A few rows:
| CPU | Article number | Affected versions | Status in v1.5 |
|---|---|---|---|
| CPU 1510SP-1 PN | 6ES7510-1DJ00-0AB0 | All versions | «Currently no fix is planned» |
| CPU 1510SP-1 PN | 6ES7510-1DJ01-0AB0 | All versions | «Currently no fix is planned» |
| CPU 1512SP-1 PN | 6ES7512-1DK01-0AB0 | All versions | «Currently no fix is planned» |
| CPU 1510SP-1 PN | 6ES7510-1DK03-0AB0 | — | new hardware version with new secure boot |
| CPU 1512SP-1 PN | 6ES7512-1DM03-0AB0 | — | new hardware version with new secure boot |
| CPU 1518-3 PN | 6ES7518-3AT10-0AB0 | — | new hardware version with new secure boot |
The last three rows come from the Additional Information section, where Siemens lists the new hardware versions that «contain a new secure boot mechanism that resolves the vulnerability». The table is an excerpt. The full, current list is in the advisory.
The CPU 1518-3 PN (6ES7518-3AT10-0AB0) equipment manual confirms it in the technical data: «Secure Boot: Yes», «signed firmware update: Yes». That holds for that article number. Do not stretch it to other CPUs by analogy.
«Currently no fix is planned»: what it means on the shop floor
For the CPU 1510SP-1 PN with article numbers 6ES7510-1DJ00-0AB0 and 6ES7510-1DJ01-0AB0, and the 1512SP-1 PN 6ES7512-1DK01-0AB0, version 1.5 says «All versions» and «Currently no fix is planned». The same holds for every affected article number in the list, not just these: as of today the advisory plans no firmware that closes the hole.
Our reading, which the advisory does not spell out in these words: the fix exists only as different hardware, a CPU with a different article number. For the CPU you have in the field there are two routes, mitigate or replace. No TIA Portal setting protects the bootloader of an affected CPU.
The mitigations
Siemens «recommends to assess the risk of physical access to the device… and to implement measures to make sure that only trusted personnel have access». The Workarounds and Mitigations section turns that into an object: «Restrict physical access to affected devices to trusted personnel to avoid hardware tampering (e.g., place the devices in locked control cabinets)». The CISA advisory repeats the same measure.
For this vulnerability the mitigation is a lock and a key procedure. Protecting network access stays among the advisory’s general recommendations («strongly recommends to protect network access to devices»), but it does not close this hole: the attack does not come over the network.
In version 1.5 of SSA-482757, no affected article number has a planned fix.
Siemens PLC vulnerabilities: how to decide, the three outcomes
The Siemens Operational Guidelines say a new vulnerability «should be evaluated for relevance» and give three possible outcomes: «No action, as existing measures provide sufficient protection», «Additional external measures», «Installation of latest firmware updates».
NIST SP 800-82 Rev. 3 covers who decides and when: «When and how to deploy patches should be determined by knowledgeable OT personnel… Patching should be deployed during planned OT outages.» Put plainly for whoever looks after the machine: the person who knows the plant makes the call, and the work happens in the planned outage, not on a Tuesday morning with the line running.
For SSA-482757 the third outcome, firmware, does not exist for any affected article number. That leaves the first two, plus replacing the CPU. A CPU swap is hardware work, so it goes into the outage just like an update would.
Decision sheet
The table below is our own summary built on the two sources above. No official text prescribes it. Use it as a guide, not a rule.
| Exposure | Machine criticality | Outage window | Action |
|---|---|---|---|
| Physical vector; CPU in a locked cabinet, keys accounted for | Any | Not needed | No technical action. Record the assessment with advisory version and date. Put the new article number on the spares list. |
| Physical vector; cabinet open or in an area third parties walk through | Low | Far off | Lock and key log now: no outage needed. Replace the CPU at the first failure or refurbishment. |
| Physical vector; cabinet open or in an area third parties walk through | High | Within a few months | Lock now. Order a CPU with the new secure boot, bench-test it, fit it in the outage. |
| Network vector; CPU reachable from the plant network | Any | Far off | External measures now (network segmentation and a firewall for the machine). Fixed firmware, if there is one, in the outage. |
| Network vector; no fix planned | Any | Any | External measures as the permanent answer, reviewed at every new advisory version. |
The last two rows are for advisories other than SSA-482757, which is physical. They are there because the sheet is reusable: the question is always who can reach the CPU, and from where.
Planning the outage
Once the decision is «replace the CPU» or «update the firmware», the real work is the preparation. Plan the outage as a job with risks of its own.
- Back up the CPU before you touch it. In TIA: «Online» menu, «Load backup from online device». The backup includes the password protecting the confidential PLC configuration data. With a CPU from FW V4.1 up, a restore needs the same password that was set when the backup was made, otherwise it cannot be restored. Whoever goes to site needs that password. More in the article on PLC and HMI backups to recover after ransomware.
- A clean spare. The Siemens Communication Function Manual: «A CPU as replacement for an existing CPU should not have a configuration or a configured password». A CPU pulled from another machine is not a ready spare.
- Old project on a new CPU. A project created with a TIA Portal version before V17 and loaded onto a V2.9 CPU behaves «with the same behavior as a configuration on an S7-1500 CPU V2.8»: in our reading, secure PG/HMI communication does not switch itself on. And a CPU from FW V3.0 running a project for older firmware turns SNMP back on with the «public» and «private» community strings. Swap the hardware without reviewing the project and you bring the old defaults with you. The protection settings are covered in the article on S7-1500 passwords and access levels.
- Firmware update, if that is the route. The S7-1500 system manual, 12/2014 edition, gives three ways (online from STEP 7, memory card, web server) and warns that the CPU goes to STOP while the update installs. That edition is old: check the path and behaviour on your TIA and firmware version.
- Test on the bench, not on the line. Try the project on the new article number on a CPU outside the plant before the outage.
- No active scans to collect versions on a live network. NIST: «Active scans may cause device instability or interfere with the device process state… should be scheduled to occur during planned OT outages whenever possible.» Read the article number in TIA or off the rating plate.
Example scenario: Line P1
Line P1 is a made-up plant, the same one used across this series: a palletising line with an S7-1500 PLC at 192.168.10.10, a Comfort HMI panel at 192.168.10.20, two ET 200SP I/O stations at 192.168.10.31 and .32, two switches, a service laptop at 192.168.10.100 and a remote access gateway at 192.168.10.2. For this scenario, and only in this article, we assume the CPU is a CPU 1512SP-1 PN, article number 6ES7512-1DK01-0AB0: a made-up assumption, chosen because that number appears in the advisory.
Step 1, the article number. The asset inventory (and, to be sure, the rating plate) says 6ES7512-1DK01-0AB0. Version 1.5 of SSA-482757 lists that number: «All versions», «Currently no fix is planned».
Step 2, the attack vector. Physical access is required. The network does not change the assessment: the gateway at 192.168.10.2 and the laptop at 192.168.10.100 are irrelevant here. The Line P1 control cabinet is what matters. In the scenario it stands on the shop floor next to the forklift aisle, and its key hangs on a hook by the door.
Step 3, criticality and window. The line runs two shifts; the next planned maintenance outage is ten weeks away. Stopping earlier to change a CPU would cost a day of production for a flaw that needs someone to open the cabinet.
Decision. Row three of the sheet. Now: the key comes off the hook and goes to the maintenance manager, with a log of who takes it; no outage. At the outage in ten weeks: CPU 1512SP-1 PN 6ES7512-1DM03-0AB0, ordered today, bench-tested beforehand with the Line P1 project, field CPU backed up at the start of the outage with the confidential-data password on hand. One week before the outage, re-read the advisory on the portal. If it is no longer version 1.5, go back to step 1.
The inventory line becomes: «192.168.10.10 — 6ES7512-1DK01-0AB0 — SSA-482757 v1.5 (14/01/2025): affected, no fix planned — mitigation: cabinet locked, key held by maintenance manager — replacement scheduled for planned outage».
What not to do
- Stop at the product name. «CPU 1510SP-1 PN» does not tell you whether you have an affected article number or a new hardware version; the article number does.
- Assume a firmware update closes SSA-482757 on an affected CPU. For the listed article numbers the advisory plans none.
- Check status on the CISA page. Since 10 January 2023 CISA does not update Siemens advisories after the first release.
- Write «mitigated» without looking at the cabinet. A lock with the key hanging next to it is not a mitigation.
- Swap the CPU with the line running because «it’s just a spare». It is work on the machine and belongs in the outage.
- Read an article number missing from this advisory as «safe». It only means this advisory does not cover it.
Limits of this article
- The SSA-482757 facts come from version 1.5 of 14 January 2025. The list of CPUs with the new secure boot may have changed: re-read the advisory on the ProductCERT portal.
- The firmware update path comes from a 2014 manual. Check it on your version.
- We do not cover other Siemens advisories, nor project compatibility between old and new article numbers: test that on the bench.
- For organisations within NIS2 scope, the directive lists vulnerability handling and disclosure among the risk-management measures. What that means for programmers is in NIS2 and industrial automation. This is not legal advice.
Sources
- Siemens ProductCERT, SSA-482757: Missing Immutable Root of Trust in S7-1500 CPU devices, version 1.5, 14 January 2025
- CISA, ICSA-23-012-08, Siemens S7-1500 CPU devices, January 2023
- CISA, ICSA-25-294-03 (note on Siemens advisories)
- Siemens, Cybersecurity for Industry – Operational Guidelines, version 2.2.1, April 2024
- NIST, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023
- Siemens, CPU 1518-3 PN (6ES7518-3AT10-0AB0) Equipment Manual, 11/2024
- Siemens, S7-1500, ET 200MP, ET 200SP Communication Function Manual, 11/2025
- Siemens, S7-1500/ET 200MP System Manual, 12/2014 (old edition)
- Siemens, ProductCERT page (CSAF and RSS)
- Directive (EU) 2022/2555 (NIS2), text on Cellar, Article 21(2)
Last checked: 29 September 2026
“Semplifica, automatizza, sorridi: il mantra del programmatore zen.”
Dott. Strongoli Alessandro
Programmatore
CEO IO PROGRAMMO srl
