Siemens became aware of a documentation ambiguity affecting SIMATIC S7 PLCs and related products [1]. SIMATIC S7 PLCs use two distinct, channel-specific security models: PLC protection levels govern PG/HMI access, while the per-variable access attributes "Accessible from HMI/OPC UA/Web API" and "Writable from HMI/OPC UA/Web API" govern OPC UA/Web API access. The TIA Portal documentation does not sufficiently explain this distinction. Operators who are unaware of it may draw incorrect conclusions about the access control boundaries across communication channels.

Siemens recommends that customers ensure secure access protection is configured as documented in the relevant product documentation, e.g.:

• SIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6)
• SIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5)
• SINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10)

TIA Portal supports configuration of below attribute properties for local tags and constants for SIMATIC S7 PLCs and related products:

• "Accessible from HMI/OPC UA/Web API" — controls whether a variable is visible to clients on HMI/OPC UA/Web API
• "Writable from HMI/OPC UA/Web API" — controls whether a variable can be modified by clients on HMI/OPC UA/Web API

The TIA Portal documentation [1] contains the following remark:

"Note, however, that you cannot implement general access protection for the tag with the "Accessible from HMI/OPC UA/Web API" attribute. Read or write access from other applications is possible even if the attribute is not enabled."

This may not emphasize the channel-specific security model distinction sufficiently. An operator reading the documentation may incorrectly conclude that the per-variable access attributes provide a unified, cross-channel access restriction, without being aware that these attributes are only enforced on OPC UA/Web API but not on PG/HMI communication. To enforce access restriction on PG/HMI communication protection levels / function rights must be applied.

This is the intended product behavior. However, operators who are unaware of this scope limitation may unknowingly deploy systems under incorrect security assumptions.

Siemens is working to update the TIA Portal documentation to improve the clarity of the scope of enforcement for per-variable access attributes.

Siemens recommends to ensure secure access protection is configured as documented in the relevant product documentation, e.g SIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6) or SIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5) or SINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10).

1. Properties of Local Tags and Constants – TIA Portal v21 Documentation
2. Siemens Industrial Security
3. SIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6)
4. SIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5)
5. SINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10)
6. Operational Guidelines Industrial Security