S7

What is S7?

S7 (SIMATIC S7) is the family of programmable controllers from Siemens, from the S7-300 and S7-400 of 1994 to today’s S7-1200 and S7-1500, and also the name of the proprietary communication protocol these PLCs use to exchange data with HMIs, SCADA systems and engineering software. The classic S7 protocol runs over TCP port 102 and is neither encrypted nor authenticated. Newer CPUs use the successor protocol S7 Comm Plus, which supports TLS and certificates in recent firmware.

S7 is widely used in industrial automation, particularly in manufacturing, process and infrastructure environments that use Siemens controllers. In European factories, water treatment plants and road tunnels, there is a good chance S7 controllers are running.

🧠 Which S7 generations and families exist?

Siemens introduced SIMATIC S7 in 1994 as the successor to SIMATIC S5 (1979). The family initially consisted of three classes: S7-200, S7-300 and S7-400. Since 2009 there has been a new generation programmed with the TIA Portal engineering suite.

Alongside these hardware lines there are derived variants: fail-safe CPUs (S7-1200F, S7-1500F) that run safety functions next to standard logic via PROFIsafe, CPUs in the ET 200SP distributed I/O system, software controllers that run as an S7-1500 on an industrial PC (the CPU 1508S since TIA Portal V20) and, since TIA Portal V19, the virtual S7-1500V, which runs as a container on a server. For very small tasks there is also the Siemens LOGO logic module, which is not an S7 PLC.

🔄 What is the difference between S7 PLCs and the S7 protocol?

In practice “S7” is used for two things, which often causes confusion:

• The hardware - the SIMATIC S7 controllers themselves, programmed in languages including ladder logic, FBD, SCL and (not on the S7-1200) STL.
• The protocol - the Siemens communication that handles engineering, operation and data exchange with those controllers.

The protocol itself comes in two variants. S7 Comm (protocol ID 0x32) is the classic protocol of the S7-300 and S7-400. S7 Comm Plus (protocol ID 0x72) is a separate, newer protocol for the S7-1200 and S7-1500. Both use TCP port 102.

The S7 protocol is distinct from PROFINET: PROFINET handles cyclic, real-time I/O exchange with field devices, while S7 communication handles acyclic tasks such as HMI operation, data reads and program downloads. Older installations also communicate over MPI and PROFIBUS.

🔧 How does the S7 protocol work?

1. Based on TCP/IP

• S7 operates via TCP port 102, the ISO-on-TCP port defined in RFC 1006
• Beneath the S7 message sit TPKT (RFC 1006) and COTP (ISO 8073), which emulate OSI transport over TCP
• Traffic flows between, for example, a SCADA system and a PLC

2. Read and write operations

• External systems can read or write memory addresses (data blocks, inputs, outputs, flags)
• Functions such as Start/Stop of the PLC, upload and download of program blocks, and status monitoring

3. No native security in classic S7 (S7-300/400)

• Traffic is not encrypted
• No authentication at protocol level, so it is susceptible to eavesdropping and manipulation

Newer systems such as the S7-1200/1500 support S7 Comm Plus with encryption and certificates via TLS. That secure communication does have to be set up in TIA Portal and requires certificate management.

The finer details of connection set-up, TSAP addressing and function codes are covered in the article on S7 Comm.

🏭 Where is S7 used?

• Communication between Siemens PLCs and SCADA and HMI software such as WinCC
• Programming and configuration from an Engineering Station with STEP 7 or TIA Portal
• Links to a Historian or MES for production and quality data
• Process automation with the Siemens DCS PCS 7, which runs on S7-400 controllers
• Remote diagnostics and maintenance via an industrial VPN or Remote Access

Common sectors include the automotive industry, food and beverage, chemicals, water management and infrastructure such as tunnels, bridges and locks. Because S7-300 and S7-400 systems often run for twenty years or more, many plants combine old and new generations on a single network.

🔐 What are the security risks of S7?

• S7 is vulnerable to:

• Unauthorised access - with classic S7, anyone who can reach port 102 can read and write variables or stop the CPU

• Man-In-The-Middle attacks - traffic can be read and altered in transit

• Unauthorised program changes - an unauthenticated download lets an attacker load their own logic into the PLC

• Well-known examples:

• Stuxnet (discovered in 2010) replaced a STEP 7 communication library and so silently loaded malicious code into S7-300 and S7-400 PLCs, while operators kept seeing normal values

• In 2019 researchers showed with Rogue7 that S7 Comm Plus on an S7-1500 could also be abused by an impersonated engineering station (CVE-2019-10929); Siemens subsequently strengthened the protection

Siemens ProductCERT publishes security advisories for SIMATIC products, including as a machine-readable CSAF feed. Include them in your vulnerability management.

🛡️ How do you secure an S7 installation in practice?

Because the classic protocol cannot be secured by itself, protection has to come from the network, configuration and management. A practical approach:

1. Inventory - use an asset inventory to record which S7 CPUs exist, which firmware they run and which systems talk to port 102.
2. Segment - place PLCs in their own zone following the zones and conduits model of IEC 62443 and the Purdue Model, using network segmentation and VLANs.
3. Filter on content - an industrial firewall with DPI can recognise S7 functions and, for example, allow only reads from the historian and permit downloads and STOP commands only from the engineering station.
4. Harden the PLC - on S7-1200/1500 set a password-protected access level, leave PUT/GET disabled unless it is really needed, and enable secure PG/HMI communication in new projects.
5. Control engineering access - use only verified engineering stations and route remote maintenance through a jump server.
6. Detect - monitor traffic with an OT IDS or anomaly detection for unexpected downloads, STOP commands and new clients.

S7-1200 and S7-1500 CPUs have four access levels:

Dutch and European context. Organisations covered by NIS2 and the Dutch Cybersecurity Act (in force since 15 August 2026) must take appropriate measures for their network and information systems; an unprotected port 102 in a drinking water or energy installation stands out immediately. Siemens withdrew the S7-300 from regular sale on 1 October 2025; after that date new modules are only available in limited quantities as spare parts. Include migration to the S7-1500 in your lifecycle management of legacy systems and protect the existing installation with the measures above until then.

❓ Frequently asked questions

Is S7 a PLC or a protocol?

S7 is both: SIMATIC S7 is the Siemens PLC family (S7-200, S7-300, S7-400, S7-1200 and S7-1500), and S7 is also the name of the proprietary protocol those PLCs communicate with. The classic protocol is called S7 Comm, and the newer variant for the S7-1200 and S7-1500 is called S7 Comm Plus.

Which port does the S7 protocol use?

The S7 protocol uses TCP port 102, the standard port for ISO-on-TCP. Both classic S7 Comm and S7 Comm Plus run over this port. A firewall that opens port 102 therefore lets every S7 function through, unless it filters on function with deep packet inspection.

Is the S7 protocol encrypted?

The classic S7 protocol of the S7-300 and S7-400 is not encrypted and has no authentication. S7 Comm Plus on an S7-1500 from firmware V2.9 or an S7-1200 from firmware V4.5 can use TLS encryption with PLC certificates when configured with TIA Portal V17 or later. That secure communication has to be set up deliberately.

What is the successor to the S7-300?

The successor to the S7-300 is the SIMATIC S7-1500, which Siemens also positions as the replacement for the S7-400. Since 1 October 2025 Siemens supplies the S7-300 only in limited quantities as spare parts. Migration requires new engineering in TIA Portal, retesting and planned downtime.

How do you secure an old S7-300 that must keep running for years?

You secure an S7-300 mainly through the network: place the PLC in a separate zone, allow only known HMI, SCADA and engineering addresses on port 102 and filter S7 functions with an industrial firewall. Monitor the traffic with an OT IDS and route engineering only through a secured jump server.

Did the S7 protocol play a role in Stuxnet?

Yes, Stuxnet abused the S7 communication between STEP 7 and Siemens PLCs. The malware replaced a communication library on the engineering station, used it to load malicious code into S7-300 and S7-400 PLCs and hid the changes from operators. It was discovered in 2010 and is regarded as the first known example of malware that sabotaged an industrial controller.

📌 In summary

S7 is both the Siemens SIMATIC PLC family and the communication protocol on TCP port 102 that those PLCs speak; in its classic form the protocol has no built-in security.

The S7-300 and S7-400 still run in many installations, but the S7-1200 and S7-1500 with S7 Comm Plus and TLS are the future. Protect existing S7 installations with segmentation, function-level filtering, PLC hardening and monitoring, and plan the migration away from the phased-out S7-300 in good time.