CVE-2020-22552
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
In Snap7 server version 1.4.1, a vulnerability allows an attacker to send a crafted packet with the COTP protocol where the last-data-unit flag is set to No and the S7 writes a var function, causing the Snap7 server to crash.
Risk Assessment
An attacker can remotely crash the Snap7 server, leading to disruption of industrial or automation systems that depend on it.
Recommendation
Update the Snap7 server to the latest available version that includes a fix for this vulnerability. If an update is not possible, restrict access to the server to trusted networks only.
Other vulnerabilities in Snap7
See all- CVE-2026-16225Medium
A security flaw in snap7 up to version 1.4.3 involves an out-of-bounds write in the TSnap7Peer::NegotiatePDULength function. The attack can be executed remotely by manipulating the PDULength argument.
- CVE-2026-15105Medium
davenardella snap7 up to version 1.4.3 contains an out-of-bounds write vulnerability in the TS7Worker::PerformFunctionRead function. The attack requires local network access. An exploit has been published and may be used.
- CVE-2026-51218High
A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.
Original NVD description (English source)
The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to No and S7 writes a var function, the Snap7 server will be crashed.