S7 Comm Plus

What is S7 Comm Plus?

S7 Comm Plus (also S7CommPlus) is the proprietary communication protocol from Siemens that S7-1200 and S7-1500 PLCs use to exchange data with TIA Portal, HMIs, SCADA systems and other clients, with built-in integrity protection and, since TIA Portal V17, encryption via TLS. It succeeds the classic S7 Comm of the S7-300 and S7-400, which has no form of authentication or encryption at all. S7 Comm Plus is not an extension of that old protocol but a separate protocol that runs over the same TCP port 102. Anyone who operates a modern Siemens installation or is responsible for its cybersecurity needs to know what protection the protocol really offers and where its limits lie.

🧠 How does S7 Comm Plus work?

S7 Comm Plus appeared with the S7-1200 (2009) and became the standard communication of the S7-1500 (presented in 2012). Like the classic protocol it uses ISO-on-TCP as defined in RFC 1006 on TCP port 102, but the packet header carries protocol ID 0x72 instead of 0x32. That is how network monitors and DPI firewalls tell the two apart.

The protocol is object-oriented: a client does not address memory locations directly but objects such as data blocks, variables and program blocks. S7 Comm Plus carries, among other things:

• Engineering - downloading and uploading programs, online diagnostics and firmware updates from the engineering station running TIA Portal
• Operation and visualisation - HMI panels and WinCC reading and writing symbolic variables
• Diagnostics - CPU status, the diagnostic buffer and the RUN and STOP operating modes

Its security has developed in two generations:

1. Legacy protection (before V17) - a proprietary scheme based on elliptic curve cryptography derives a session key per connection, which gives messages an integrity check against tampering and replay attacks. The content itself is not encrypted, and the scheme relies on a private key built into the firmware per product line.
2. Secure PG/PC and HMI communication (from V17) - since TIA Portal V17, S7-1500 firmware V2.9 and S7-1200 firmware V4.5, the connection is set up inside TLS 1.3. The CPU proves its identity with its own PLC certificate and all traffic is encrypted.

The name S7 Comm Plus therefore says little about the level of protection: only with firmware and project settings from V17 onwards is the traffic genuinely encrypted and authenticated per device.

🔄 What is the difference between S7 Comm and S7 Comm Plus?

An S7-1200 or S7-1500 also still supports classic S7 Comm for PUT/GET access by third parties. That function is disabled by default and, once enabled, opens an unauthenticated access path alongside S7 Comm Plus. Conversely, an S7-300 or S7-400 does not speak S7 Comm Plus.

🔐 Which weaknesses are known in S7 Comm Plus?

Even a protocol with built-in security is only as strong as its implementation. Researchers and Siemens itself have published several vulnerabilities in recent years:

The last finding in particular is fundamental. In October 2022 Siemens acknowledged that the global key can no longer be considered sufficiently protected, and pointed to the TLS communication and the individual passwords for confidential configuration data introduced in V17 as the structural fix. According to Siemens, legacy S7 Comm Plus now belongs only in a trusted network.

🏭 Where is S7 Comm Plus used?

• Machine building and discrete manufacturing - practically every new Siemens machine with an S7-1200 or S7-1500 talks to TIA Portal and its operator panel via S7 Comm Plus
• Process industry and utilities - links between S7-1500 CPUs and WinCC stations in water treatment, energy installations and other critical infrastructure
• Maintenance and diagnostics - service engineers going online with a laptop, locally or via remote access over a VPN
• Integration with IT - S7 Comm Plus is not publicly documented, so third-party historians and other systems usually connect through the integrated OPC UA server of the S7-1500 or via PUT/GET rather than through S7 Comm Plus itself

🔧 How do you enable secure communication?

A practical approach for new and existing installations:

1. Inventory firmware - check the firmware version of every CPU. Below S7-1500 V2.9 and S7-1200 V4.5, TLS is not possible, and below S7-1500 V2.9.2 and S7-1200 V4.5.0, CVE-2020-15782 and CVE-2022-38465 are not fixed.
2. Update TIA Portal and firmware - migrate the project to TIA Portal V17 or later and update the firmware as part of patch management, after testing on a spare CPU or in simulation.
3. Configure protection - set the CPU to “only allow secure PG/PC and HMI communication”, set a password for the confidential PLC configuration data and choose a suitable access level (full access, read access, HMI access or no access).
4. Handle certificates - let TIA Portal generate the PLC certificate or import one from your own CA, and record expiry and renewal in your certificate management.
5. Update HMIs and SCADA - older panels and WinCC versions do not speak TLS; plan their upgrade, because a mixed mode keeps the unprotected legacy traffic alive.
6. Keep PUT/GET disabled - enable classic S7 Comm only when a third-party system really needs it, and then limit the exchange to separate, non-optimised data blocks containing only the data that system needs.
7. Segment and monitor - restrict TCP 102 with a firewall or industrial firewall with access control to known engineering, HMI and SCADA addresses, route remote engineering through a jump server and flag new clients via monitoring, anomaly detection or a SIEM.

Bear in mind that network monitoring sees less after the switch to TLS: a passive sensor still recognises who is talking to which PLC, but no longer which function is being executed. Plan your detection at connection level and on logging in the CPU and TIA Portal.

Dutch and European context. Organisations covered by NIS2 and the Dutch Cybersecurity Act, in force since 15 August 2026, must take appropriate measures for their network and information systems. Encrypted and authenticated PLC communication fits a Zero Trust architecture and the requirements of IEC 62443 for protected communication between zones. An S7-1500 with outdated firmware and open legacy traffic is a concrete finding in an audit.

❓ Frequently asked questions

Which port does S7 Comm Plus use?

S7 Comm Plus uses TCP port 102, the same port as classic S7 Comm. Even with TLS encryption the traffic stays on port 102. A firewall that filters on port number alone therefore cannot tell S7 Comm Plus and S7 Comm apart.

Is S7 Comm Plus always encrypted?

S7 Comm Plus is not always encrypted. Older firmware only uses a proprietary integrity protection without encrypting the content. Genuine TLS encryption requires TIA Portal V17 or later with S7-1500 firmware V2.9 or S7-1200 firmware V4.5 and higher.

Can I analyse S7 Comm Plus traffic in Wireshark?

S7 Comm Plus traffic can be analysed in Wireshark with a separate dissector plugin, because the standard version only decodes classic S7 Comm. With TLS communication you only see encrypted packets without the session keys. For troubleshooting you need to load those keys from a key log file into the capture.

Does S7 Comm Plus protect against an attack like Stuxnet?

Stuxnet targeted S7-300 and S7-400 CPUs via classic S7 Comm, and S7 Comm Plus makes a comparable attack harder through integrity protection and TLS encryption. However, an attacker who takes over the engineering station itself can still push changes through that legitimate connection. Protecting the engineering station, password-protected access levels and monitoring of program changes therefore remain necessary.

What is the global key of the S7-1200 and S7-1500?

The global key is a private key that Siemens built into the firmware of S7-1200 and S7-1500 CPUs per product line for legacy communication and the protection of configuration data. Researchers showed in 2022 that this key can be recovered (CVE-2022-38465). Siemens therefore advises updating firmware and allowing only secure PG/PC and HMI communication.

Can an S7-300 use S7 Comm Plus?

An S7-300 or S7-400 cannot use S7 Comm Plus; these CPUs only speak classic S7 Comm. Their protection comes entirely from the network, through segmentation, filtering and monitoring. In the long run, migrating to the S7-1500 is the answer for these legacy systems.

📌 In summary

S7 Comm Plus is the Siemens protocol of the S7-1200 and S7-1500 on TCP port 102, with integrity protection and, since TIA Portal V17, TLS encryption with a certificate per PLC.

The protocol is a major step forward from the unprotected S7 Comm, but the older legacy protection has been broken several times, culminating in the recoverable global key of 2022. You only reap the full benefit by updating firmware and TIA Portal, allowing secure communication only, managing certificates, and continuing to segment and monitor PLC communication as part of a secure OT network.