Key takeaways
- Inventory every S7 device and engineering workstation, with model and firmware version — you cannot assess exposure or patch status for hardware you haven't listed.
S7comm is Siemens' proprietary protocol for programming, monitoring and controlling its S7 family of PLCs — S7-200, S7-300, S7-400, S7-1200 and S7-1500 — over TCP port 102, and Siemens S7 hardware keeps reappearing in CISA advisories for the same structural reason DNP3 and Modbus do: the protocol was designed for isolated plant networks and carries no authentication for most operations, so whatever actually stops an attacker has to come from credentials, patching and network segmentation, not the protocol itself. An August 2026 joint US government advisory shows that gap is not theoretical — it describes active reconnaissance and tool-building against internet-exposed S7 PLCs happening right now.
What S7comm is, and why it has no authentication by default
S7comm was built for a generation of PLCs installed on networks that were never expected to touch the internet, and the protocol's structure reflects that assumption: most read and write operations carry no credential, session token or message signature, so any device that can reach a PLC's TCP port 102 can issue commands it will accept. Siemens addressed this with S7CommPlus, introduced with firmware updates in 2014 for the S7-1200 and S7-1500 families (firmware version 4.0 and later), adding encryption and authentication. That leaves a real split in the installed base: S7CommPlus-capable hardware running current firmware gets a meaningfully stronger protocol, while the S7-200, S7-300 and S7-400 families — many installed decades ago and still in service — have no equivalent option and communicate in the clear over plain S7comm.
What did CISA's August 2026 advisory actually find?
On 19 August 2026, the NSA, CISA, FBI, Department of Energy and EPA published a joint cybersecurity advisory, AA26-231A, "Defending Against an Active Threat to Siemens S7 Series PLCs," covering the S7-200, S7-300, S7-400, S7-1200 (CPU variants 1211C through 1217C) and S7-1500 families, including F-series safety controllers. The finding at the center of the advisory is about tooling, not a new flaw: threat actors are combining snap7.dll and python-snap7 — open-source libraries built to talk to Siemens PLCs over S7comm — with AI-assisted scripting to produce custom tools that mimic legitimate OT monitoring software, giving read and write access to PLC memory, configuration data and ladder-logic programs. Attackers find targets first using internet-scanning services such as Censys and ZoomEye to identify internet-exposed or insufficiently segmented S7 devices, the same discovery method named in CISA's broader Internet Exposure Reduction Guidance. The EPA's presence among the issuing agencies signals water utilities as a primary intended audience, alongside energy and manufacturing operators also named in the advisory's scope.
Is this a new vulnerability, or a known exposure problem?
CISA's own advisory enumerates no new vulnerabilities — it defers generically to Siemens ProductCERT and existing CISA ICS advisories for specific CVEs — and describes the activity as exploiting known vulnerabilities, weak or default credentials, and unnecessary internet exposure. Siemens' own public statement reinforces this: the company said it had not identified new vulnerabilities or an elevated attack volume in its ICS product line, and that AA26-231A describes methods that may exploit misconfigurations its guidance already addresses, not a newly discovered flaw. In other words, the change is in attacker tradecraft and scale — AI-generated exploitation scripts built on long-available open-source tooling — not in the underlying attack surface. That framing lines up with a pattern that long predates this advisory: CISA's 2011-era ICS-ALERT-11-204-01B documented a hardcoded diagnostic-shell credential (CVE-2011-4566) in certain S7-300 PLCs shipped before October 2009, discovered in the wave of post-Stuxnet ICS research — a different, older flaw, but the same underlying lesson that S7-family exposure has been a known, documented risk for well over a decade.
Does this connect to a broader exposure pattern?
Yes — CISA's separate AA26-097A advisory (7 April 2026, updated 22 July 2026), on Iranian-affiliated actors exploiting internet-exposed PLCs across US critical infrastructure, explicitly named Siemens S7-1200 devices alongside Rockwell and Schneider Electric hardware as targets reached directly over the internet, including via cellular-modem connections. See CISA BOD 23-02: what it requires, and what OT/ICS operators should take from it for how this same internet-exposed-management-interface pattern plays out in CISA's federal IT guidance, and why the agency keeps repeating the same remediation advice across both worlds.
What should a Siemens S7 asset owner check first?
In the order CISA's own advisories weight them:
Inventory every S7 device and engineering workstation, with model and firmware version — you cannot assess exposure or patch status for hardware you haven't listed. Confirm none are reachable from the public internetBoth AA26-231A and AA26-097A put removing or restricting internet exposure first, and both describe attackers finding targets via the same public scanning services (Censys, Shodan, ZoomEye) a defender can use against their own footprint first. Apply current patchesreferenced in Siemens ProductCERT advisories (such as SSA-568427's weak-key-protection fix for S7-1200/S7-1500 CPU families) and the corresponding CISA ICS advisories for the specific models in use. Replace default or weak credentials and restrict engineering-software access(TIA Portal, STEP 7) to allowlisted, hardened workstations — AA26-231A names weak and default credentials as one of the three conditions attackers are actively exploiting. Watch for AA26-231A's specific hunt indicators: anomalous S7comm activity on port 102 outside planned change windows, sequential network scanning behavior, and Python processes importing the snap7 library on engineering workstations.
A passive pcap read is a practical way to get the inventory and exposure answers in steps 1 and 2 without touching a running PLC: SoftWSP's OT Snapshot service identifies what is actually speaking S7comm and other ICS protocols on a recorded network segment, and its AI-assisted report maps findings to the specific advisory and firmware version they relate to, with an engineer reviewing every finding before it ships — see OT Snapshot.
Dates, affected product lists and technical details above are drawn directly from CISA's AA26-231A and AA26-097A advisory pages, CISA's 2011 ICS-ALERT-11-204-01B, and Siemens' own ProductCERT advisory SSA-568427. This guide is general information, not a substitute for Siemens' own product-specific security guidance or a current CISA ICS advisory search for your exact hardware and firmware version.
Sources
- CISA/NSA/FBI/DOE/EPA Advisory AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs (19 August 2026)
- CISA/FBI/NSA/EPA/DOE/US Cyber Command Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (7 April 2026, updated 22 July 2026)
- CISA ICS Alert ICS-ALERT-11-204-01B: Siemens S7-300/S7-400 Hardcoded Credentials, Update B
- Siemens ProductCERT SSA-568427: Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families
- CISA: Internet Exposure Reduction Guidance (resources-tools)
Frequently asked questions
Does S7comm have built-in authentication or encryption?
No. S7comm is Siemens' proprietary protocol for communication with S7-200, S7-300, S7-400, S7-1200 and S7-1500 PLCs, running over TCP port 102, and it was designed for an era of isolated plant networks rather than internet connectivity. The base protocol has no native authentication or encryption for most read and write operations, and as a proprietary (not openly published) protocol it also lacks the kind of public documentation that lets independent researchers and defenders fully assess it the way an open standard like Modbus or DNP3 can be. Siemens introduced an authenticated, encrypted successor, S7CommPlus, starting with firmware updates in 2014 for the S7-1200 and S7-1500 families.
What did CISA's August 2026 advisory on Siemens S7 PLCs actually find?
On 19 August 2026, the NSA, CISA, FBI, Department of Energy and EPA issued a joint cybersecurity advisory, AA26-231A, titled 'Defending Against an Active Threat to Siemens S7 Series PLCs,' covering the full S7-200, S7-300, S7-400, S7-1200 (1211C through 1217C CPU variants) and S7-1500 (including F-series safety controllers) product families. The advisory describes threat actors pairing open-source industrial automation libraries — specifically snap7.dll and python-snap7 — with AI-assisted scripting to build custom tools that mimic legitimate OT monitoring software, giving read and write access to PLC memory, configuration data and ladder logic over the S7comm protocol on TCP port 102. Attackers use internet-scanning services such as Censys and ZoomEye to find internet-exposed or insufficiently segmented S7 devices first.
Is AA26-231A describing a new vulnerability in Siemens S7 PLCs?
No — the advisory itself enumerates no new vulnerabilities, deferring to Siemens ProductCERT and existing CISA ICS advisories for specific CVEs, and describes exploitation of known weaknesses (weak or default credentials, unnecessary internet exposure) rather than a previously undisclosed flaw. Siemens has stated it has not identified new vulnerabilities or an elevated attack volume in its product line, framing AA26-231A as describing a change in attacker tradecraft and scale — AI-assisted tooling built on existing open-source libraries — rather than a new hole in the protocol or the hardware.
Does S7CommPlus fix the authentication problem?
Partially, and only where it is actually running. S7CommPlus adds encryption and authentication and is implemented in S7-1200 and S7-1500 PLCs running firmware version 4.0 or later, a real improvement over plain S7comm. It does not reach the large installed base of S7-200, S7-300 and S7-400 devices AA26-231A explicitly covers — those older families, many installed decades ago, communicate over plain S7comm with no equivalent available. Even on S7-1200/S7-1500 hardware capable of S7CommPlus, Siemens' own ProductCERT advisory SSA-568427 describes a separate weak-key-protection issue in how those CPU families protect a built-in global private key, which is a cryptographic implementation weakness distinct from whether S7CommPlus is enabled at all.
What should an asset owner running Siemens S7 PLCs check first?
In the order CISA's own advisories recommend: inventory every Siemens S7 device and engineering workstation on the network, including model and firmware version; confirm none are reachable from the public internet (AA26-097A's Iranian-PLC advisory and AA26-231A both start their mitigation lists with removing or restricting internet exposure); apply current firmware and engineering-software patches referenced in Siemens ProductCERT and CISA ICS advisories for the specific models in use; replace default or weak credentials and restrict TIA Portal/STEP 7 access to allowlisted engineering workstations; and watch for the specific AA26-231A hunt indicators — anomalous S7comm activity on port 102 outside change windows, sequential network scanning, and Python processes importing the snap7 library on engineering workstations.
In this cluster
