Full Report
Multiple Siemens products are vulnerable to the “Copy Fail” vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Analysis Summary
# Vulnerability: "Copy Fail" in Multiple Siemens Industrial Products
## CVE Details
- **CVE ID:** CVE-2026-31431
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-669: Incorrect Resource Transfer Between Spheres
## Affected Systems
- **Products:**
- SIMATIC AX Runtime (Core Linux, Debian, VMWare, arm64)
- SIMATIC CN 4100
- SIMATIC HMI Unified Comfort Panels (including PRO and Neutral design families)
- SIPLUS HMI MTP400 / MTP700 Unified Basic Panels
- SIMATIC IOT family devices
- **Versions:**
- SIMATIC CN 4100: All versions < V6.0
- SIMATIC HMI MTP1200 Comfort Pro: All versions < V21 Update 2 SR1
- SIMATIC AX Runtime: All versions
- SIPLUS HMI MTP400/700: All versions based on affected WinCC Unified Basic versions
- **Configurations:** Systems utilizing affected Linux kernel versions specifically involving the `algif_aead` crypto component.
## Vulnerability Description
Technically known as the "Copy Fail" vulnerability, this flaw resides in the Linux kernel's `algif_aead` (Authenticated Encryption with Associated Data) implementation. The issue stems from high-complexity code intended to allow "in-place" operations where source and destination come from different mappings. The flaw leads to incorrect resource transfers between memory spheres, requiring the kernel to revert to "out-of-place" operations to maintain security boundaries.
## Exploitation
- **Status:** Not explicitly stated as exploited in the wild (Advisory Version 1.0).
- **Complexity:** Low
- **Attack Vector:** Local (Requires local access to the system to trigger the flaw).
## Impact
- **Confidentiality:** High (Potential for unauthorized data access).
- **Integrity:** High (Potential for data modification).
- **Availability:** High (Potential for system instability or crashes).
## Remediation
### Patches
- **SIMATIC CN 4100:** Update to V6.0 or later.
- **SIMATIC HMI MTP1200 Comfort Pro:** Update to V21 Update 2 SR1 or later.
- **Other HMI Panels:** Consult the specific Siemens support links for WinCC Unified V18/V19/V21 updates.
### Workarounds
For products where no fix is currently available (e.g., SIMATIC AX Runtime):
- Apply general industrial security recommendations: Ensure the devices are not exposed to untrusted networks.
- Restrict local access to authorized personnel only to mitigate the "Local" attack vector.
- Follow the "Defense-in-Depth" technical perspective provided by Siemens ProductCERT.
## Detection
- **Detection methods and tools:** Monitoring for unexpected kernel panics or instability related to cryptographic operations. Use vulnerability scanners capable of identifying Linux kernel version `CVE-2026-31431`.
## References
- **Vendor Advisory:** hxxps://cert-portal.siemens[.]com/productcert/html/ssa-328642.html
- **Siemens ProductCERT:** hxxps://www.siemens[.]com/cert/advisories
- **SIMATIC CN 4100 Update:** hxxps://support.industry.siemens[.]com/cs/ww/en/view/109814144/
- **SIMATIC HMI Update:** hxxps://support.industry.siemens[.]com/cs/ww/en/view/109825605/