snap7 vulnerabilities
4 known CVE vulnerabilities in snap7, translated and rated.
- CVE-2026-16225Medium
A security flaw in snap7 up to version 1.4.3 involves an out-of-bounds write in the TSnap7Peer::NegotiatePDULength function. The attack can be executed remotely by manipulating the PDULength argument.
- CVE-2026-15105Medium
davenardella snap7 up to version 1.4.3 contains an out-of-bounds write vulnerability in the TS7Worker::PerformFunctionRead function. The attack requires local network access. An exploit has been published and may be used.
- CVE-2026-51218High
A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.
- CVE-2020-22552High
In Snap7 server version 1.4.1, a vulnerability allows an attacker to send a crafted packet with the COTP protocol where the last-data-unit flag is set to No and the S7 writes a var function, causing the Snap7 server to crash.