Executive brief
Snap7 is an open-source communication library used to interface with Siemens S7 PLCs (Programmable Logic Controllers) in industrial environments. A vulnerability in the library's server component allows a remote attacker to crash the service by sending a specially crafted network packet. This could lead to a denial-of-service (DoS) condition, disrupting industrial monitoring or control operations that rely on this library.
Technical details
A heap buffer overflow exists in Snap7 v1.4.3 within the `TS7Worker::PerformFunctionWrite()` function located in `src/core/s7_server.cpp`. The vulnerability is triggered during the parsing of malformed S7 `WriteVar` requests. An attacker can exploit this by sending a specially crafted TCP packet to a Snap7 server instance, leading to an out-of-bounds read/write on the heap. This results in an immediate crash of the worker thread or the entire server process (Denial of Service). The issue is reproducible over the network without authentication. As of the advisory date, the issue was reported via the project's GitHub repository.
Affected products
- Snap7 Project (davenardella) Snap7 1.4.3
Timeline
- 2026-06-29: advisory: CVE published to NVD dataset
- 2026-06-29: disclosed: Issue reported on GitHub repository