EUVD-2026-42468
GHSA-x9cg-5m94-27cv
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network vector (AV:A) as exploitation is constrained to local segment; no authentication required per protocol design; scope unchanged with partial CIA impact consistent with CVSS 4.0 VC/VI/VA:L.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the component ReadVar Request Handler. This manipulation causes deserialization. The attack requires access to the local network. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper input validation in the snap7 library (versions up to 1.4.3) allows adjacent-network attackers to trigger a deserialization flaw via crafted ReadVar requests processed by TS7Worker::PerformFunctionRead in the S7 server component. Exploitation results in partial confidentiality, integrity, and availability impact against the snap7 server process - a concern in industrial OT environments where PLC communication libraries may interface with safety-relevant systems. No vendor-released patch exists as the maintainer has not responded to disclosure, and a publicly available proof-of-concept exploit lowers the barrier to exploitation.
Technical ContextAI
snap7 is an open-source C++ library for communicating with Siemens S7-family PLCs via the S7 protocol, commonly embedded in industrial control system (ICS) and SCADA integration layers. The vulnerable component is the server-side ReadVar request handler, specifically the TS7Worker::PerformFunctionRead function in src/core/s7_server.cpp. The root cause class is CWE-20 (Improper Input Validation): incoming ReadVar protocol messages are not properly validated before deserialization processing, allowing a malformed packet to influence internal deserialization behavior in unintended ways. This is distinct from CWE-502 (Deserialization of Untrusted Data) - the tag 'Deserialization' reflects how manipulation manifests rather than a pure serialization gadget chain. No CPE strings were provided in the source intelligence; affected versions are identified as up to and including 1.4.3 per VulDB report 376946.
RemediationAI
No vendor-released patch has been identified at time of analysis - the snap7 maintainer had not responded to the disclosure as of the report date. Monitor https://github.com/davenardella/snap7/issues/16 for any upstream response or fix. As a primary compensating control, restrict network access to snap7 server instances using firewall rules or VLAN segmentation so only explicitly trusted PLC engineering workstations or SCADA hosts can reach the snap7 listening port; this eliminates the adjacent-network prerequisite and is the most effective mitigation. If snap7 is deployed in client-only mode within an application, disabling or not initializing the server component entirely removes the attack surface with no operational trade-off. Organizations unable to apply network controls should consider replacing snap7 with a supported alternative or pinning to a vendor-supported PLC communication SDK that receives active security maintenance. No upstream advisory URL is available.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today