CVE-2026-111280
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
Risk Assessment
A malicious or impersonated PLC can remotely crash SCADA, HMI, or gateway processes and corrupt memory, potentially leading to denial of service and possible code execution. The risk affects industrial environments using snap7 for PLC communication.
Recommendation
Update snap7 to a version newer than 1.4.3 if available, or implement validation of the DataLength field in ReadVar responses. Segment the industrial network and restrict communication to trusted PLCs.
Other vulnerabilities in snap7
See all- CVE-2026-90572Medium
A vulnerability was determined in davenardella snap7 up to 1.4.3 in the TSnap7MicroClient::opUpload function of src/core/s7_micro_client.cpp. Manipulation of the DataLen argument can lead to memory corruption. The attack can be executed remotely and the exploit has been publicly disclosed. The project was informed but has not responded.
- CVE-2026-16225Medium
A security flaw in snap7 up to version 1.4.3 involves an out-of-bounds write in the TSnap7Peer::NegotiatePDULength function. The attack can be executed remotely by manipulating the PDULength argument.
- CVE-2026-15105Medium
davenardella snap7 up to version 1.4.3 contains an out-of-bounds write vulnerability in the TS7Worker::PerformFunctionRead function. The attack requires local network access. An exploit has been published and may be used.
- CVE-2026-51218High
A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.
- CVE-2020-22552High
In Snap7 server version 1.4.1, a vulnerability allows an attacker to send a crafted packet with the COTP protocol where the last-data-unit flag is set to No and the S7 writes a var function, causing the Snap7 server to crash.
Original NVD description (English source)
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS