Siemens fixes medium-severity Copy Fail flaw in SIPLUS, SIMATIC families

En bref

• CVE-2026-31431 (Copy Fail) affects multiple Siemens industrial products, including SIPLUS, SIMATIC, SIMATIC AX, SIMATIC CN 4100, and SIMATIC HMI.
• Siemens has released updates for some products and is still preparing fixes for others.
• Interim mitigations are available and should be applied where patches are not yet ready.
• Medium severity, but operational technology environments should prioritize review and remediation.
• IT admins should inventory affected devices, apply updates, and monitor Siemens advisories.

Siemens has published a security advisory for a medium-severity vulnerability tracked as CVE-2026-31431, which carries the internal label Copy Fail. The issue spans several product lines, including SIPLUS, SIMATIC, SIMATIC AX, SIMATIC CN 4100, and SIMATIC HMI. For some of these, Siemens has already issued firmware or software fixes; for others, the company is still preparing patches and has offered interim mitigations.

Educational institutions and other organizations that rely on these industrial automation components—whether for building management systems, laboratory equipment, or vocational training gear—should assess whether they have any of the affected devices. The breadth of the affected catalog means exposure is not limited to a single product family.

Although rated medium, the flaw still warrants prompt attention because operational technology often sits on networks where patching is complex and downtime is costly. A successful exploit could disrupt device behavior or provide a foothold for deeper network access, depending on deployment. Siemens has advised customers to apply available updates and to follow its recommended mitigations until all fixes are ready.

This disclosure is part of Siemens' regular ProductCERT process. The company has a track record of publishing advisories alongside patches, and this case follows that pattern: some fixes are out, others are in progress.

What to watch: keep an eye on Siemens' advisory page for updated firmware releases for SIMATIC AX and CN 4100, and verify that mitigations such as network segmentation or access controls are in place for any device you cannot yet patch. Schools should also review whether these systems are reachable from general-purpose networks.

À faire maintenant

1. Inventory every Siemens device on your network, specifically checking for SIPLUS, SIMATIC, SIMATIC AX, SIMATIC CN 4100, and SIMATIC HMI models, and record firmware versions.
2. Apply the updates Siemens has already released for affected products as soon as possible, following change-control procedures for operational technology.
3. For products where Siemens is still preparing fixes, implement the recommended mitigations from the advisory, such as placing devices behind firewalls, restricting remote access, and disabling unnecessary services.
4. Consult the official Siemens security advisory for CVE-2026-31431 to get specific remediation guidance and workarounds.
5. Segment affected industrial control systems from general IT networks and the internet; use VPNs or jump hosts for any required remote management.
6. Enable logging and monitor for anomalous activity on these devices, and report suspicious behavior to your security team.
7. Subscribe to Siemens security notifications and schedule a follow-up review when additional patches become available.

Références CVE

• CVE-2026-31431

Source originale

CISA Advisories