SIMATIC S7-1500 TM MFP - BIOS

productUS

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical25high15medium0low

updated 2026-10-27

vulnerabilities (43)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-0179US	high7.8	1.94% (80th)	Exploit	no fix	2023-03-27	—
CVE-2023-3390US	high7.8	0.91% (60th)	Exploit	no fix	2023-06-28	—
CVE-2022-20421US	high7.8	0.63% (50th)	Exploit	no fix	2022-10-11	—
CVE-2023-4147US	high7.8	0.56% (46th)	Exploit	no fix	2023-08-07	—
CVE-2023-3776US	high7.8	0.51% (43rd)	Exploit	no fix	2023-07-21	—
CVE-2023-4128US	—	—	Exploit	no fix	2023-08-10	—
CVE-2022-3435US	medium4.3	5.18% (92nd)	—	no fix	2022-10-08	—
CVE-2021-42377US	critical9.8	3.62% (89th)	—	no fix	2021-11-15	—
CVE-2022-28391US	high8.8OT elevated	3.52% (89th)	—	no fix	2022-04-03	—
CVE-2021-42380US	high7.2	3.09% (88th)	—	no fix	2021-11-15	—
CVE-2021-42385US	high7.2	2.79% (86th)	—	no fix	2021-11-15	—
CVE-2021-42381US	high7.2	2.79% (86th)	—	no fix	2021-11-15	—
CVE-2021-42379US	high7.2	2.79% (86th)	—	no fix	2021-11-15	—
CVE-2021-42382US	high7.2	2.76% (86th)	—	no fix	2021-11-15	—
CVE-2021-42386US	high7.2	2.73% (86th)	—	no fix	2021-11-15	—
CVE-2021-42384US	high7.2	2.73% (86th)	—	no fix	2021-11-15	—
CVE-2021-42378US	high7.2	2.73% (86th)	—	no fix	2021-11-15	—
CVE-2021-28831US	high7.5	2.72% (86th)	—	no fix	2021-03-19	—
CVE-2021-42383US	high7.2	2.21% (83rd)	—	no fix	2021-11-15	—
CVE-2023-31248US	high7.8	1.89% (79th)	—	no fix	2023-07-05	—
CVE-2022-2585US	high7.8	1.28% (70th)	—	no fix	2024-01-08	—
CVE-2023-0394US	medium5.5OT elevated	1.02% (63rd)	—	no fix	2023-01-26	—
CVE-2023-4004US	high7.8	0.92% (60th)	—	no fix	2023-07-31	—
CVE-2023-4273US	medium6.7	0.65% (51st)	—	no fix	2023-08-09	—
CVE-2021-42374US	medium5.3	0.62% (50th)	—	no fix	2021-11-15	—
CVE-2022-41222US	high7.0	0.49% (42nd)	—	no fix	2022-09-21	—
CVE-2022-3586US	medium5.5	0.49% (42nd)	—	no fix	2022-10-19	—
CVE-2021-42376US	medium5.5	0.43% (37th)	—	no fix	2021-11-15	—
CVE-2021-42375US	medium5.5	0.41% (35th)	—	no fix	2021-11-15	—
CVE-2021-42373US	medium5.5	0.41% (35th)	—	no fix	2021-11-15	—
CVE-2022-4662US	medium5.5	0.37% (31st)	—	no fix	2022-12-22	—
CVE-2022-1882US	high7.8	0.37% (30th)	—	no fix	2022-05-26	—
CVE-2022-2905US	medium5.5	0.36% (30th)	—	no fix	2022-09-09	—
CVE-2022-39190US	medium5.5	0.33% (26th)	—	no fix	2022-09-02	—
CVE-2022-21233US	medium5.5OT elevated	0.33% (26th)	—	no fix	2022-08-18	—
CVE-2023-4015US	high7.8	0.29% (22nd)	—	no fix	2023-09-06	—
CVE-2021-20269US	medium5.5OT elevated	0.25% (17th)	—	no fix	2022-03-10	—
CVE-2023-3610US	high7.8	0.25% (16th)	—	no fix	2023-07-21	—
CVE-2022-3028US	high7.0	0.23% (14th)	—	no fix	2022-08-31	—
CVE-2025-8058US	—	0.22% (13th)	—	no fix	2025-07-23	—
CVE-2022-40307US	medium4.7	0.21% (11th)	—	no fix	2022-09-09	—
CVE-2022-20422US	high7.0	0.19% (9th)	—	no fix	2022-10-11	—
CVE-2023-2898US	medium4.7	0.19% (9th)	—	no fix	2023-05-26	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-416Use After Free23 CVEs
CWE-125Out-of-bounds Read6 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')5 CVEs
CWE-476NULL Pointer Dereference4 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-311Missing Encryption of Sensitive Data3 CVEs
CWE-121Stack-based Buffer Overflow2 CVEs
CWE-667Improper Locking2 CVEs

sources (1)

Which sources assert this record, and when.

USCISA CSAF OT advisories (ICS)43 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan