snap7 CVE-2026-111280

Requires the snap7 client to establish an S7 connection to and perform a read (ReadVar) against an attacker-controlled, rogue, or impersonated PLC - i.e., the attacker must occupy a trusted position in the S7 communication path (spoofing/MITM on the OT network or a compromised/rogue device), which is exactly what the AT:P metric encodes. The malicious peer must return a crafted ReadVar response whose DataLength field (up to 65535 bytes) exceeds the caller's buffer, triggering the out-of-bounds memcpy. Limiting factors: it is NOT exploitable against a client communicating only with legitimate PLCs, so the primary defensive control is network trust and segmentation of the OT S7 path; no authentication is required (PR:N) and no user interaction is needed (UI:N). Affects snap7 versions through 1.4.3.

The CVSS 4.0 base score of 8.3 (High) is driven by VI:H and VA:H with AV:N/AC:L/PR:N/UI:N, reflecting unauthenticated memory corruption and process crash reachable over the network. The single most important modifier is AT:P (Attack Requirements: Present): exploitation is not a classic inbound remote hit but a reversed-trust, client-side flaw - the victim snap7 client must connect to and read from an attacker-controlled, rogue, or impersonated S7 PLC, which requires the attacker to hold a trusted position in the OT communication path. VC:N confirms there is no direct confidentiality impact; the realistic outcome is denial of service (crashing SCADA/HMI/gateway processes) with potential for memory-corruption-driven code execution (CWE-787 out-of-bounds write), though no exploit demonstrating code execution is provided. No EPSS score, no CISA KEV listing, and no public POC are present in the data, so there is no evidence of active or widespread exploitation - the priority here rests on severity and the sensitive ICS/OT deployment context rather than on exploitation telemetry. Net: a genuinely serious memory-safety bug for OT operators, but the AT:P precondition (attacker must impersonate the PLC) meaningfully narrows real-world exploitability compared to the headline 8.3, so it should be treated as important-to-patch rather than a drop-everything emergency absent evidence of exploitation.

An attacker who can impersonate or spoof a Siemens S7 PLC on the OT network (e.g., via a rogue device, ARP/MITM spoofing, or a compromised PLC) waits for a snap7-based client to perform a read. When the client issues a ReadVar request, the attacker returns a crafted response with a DataLength field up to 65535 bytes, triggering a memcpy that overflows the caller's buffer, corrupting memory and crashing the SCADA, HMI, or gateway process. No public exploit code was identified in the provided data.