EUVD-2026-40244
GHSA-6m46-rpq9-jh59
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Server-side packet processing crash requires no user interaction; UI:R in provided vector is inconsistent with the described mechanism and appears to be a scoring error.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
AnalysisAI
Heap buffer overflow in snap7 v1.4.3 crashes the embedded S7 server when processing a specially crafted write function packet targeting TS7Worker::PerformFunctionWrite() in /core/s7_server.cpp. Systems deploying snap7 as an S7-compatible communication server - common in industrial SCADA, HMI, and IoT gateway applications bridging to Siemens S7-series PLCs - can be disrupted remotely with no privileges required per the CVSS PR:N designation. No public exploit identified at time of analysis, and the EPSS score of 0.19% (8th percentile) reflects minimal current exploitation activity; however, operational impact in OT environments can exceed what the CVSS Availability score alone suggests.
Technical ContextAI
snap7 is an open-source C++ library implementing the Siemens S7 communication protocol over TCP/IP, enabling connectivity to Siemens S7-300, S7-400, S7-1200, and S7-1500 PLCs. The vulnerable code path lives in the server component: TS7Worker::PerformFunctionWrite() in /core/s7_server.cpp processes incoming S7 write function requests from connected clients. CWE-122 (Heap-based Buffer Overflow) indicates that attacker-controlled data within the crafted packet overflows a heap-allocated buffer - most likely due to missing or insufficient length validation before a memory copy operation, a common pattern in protocol parsing code. The CPE provided (cpe:2.3:a:n/a:n/a) is a placeholder and provides no version-bounding information; the authoritative product reference is the snap7 GitHub repository at https://github.com/davenardella/snap7. The affected version is explicitly v1.4.3. In OT deployments, snap7 is typically embedded in SCADA middleware, MES systems, soft-PLC implementations, and protocol gateways, making the server component an attractive target for disrupting industrial process communication.
RemediationAI
No vendor-released patch has been identified at time of analysis. The GitHub issue at https://github.com/davenardella/snap7/issues/14 should be actively monitored for maintainer response, a fix commit, or a patched release. Until a patch is confirmed, apply network-level compensating controls: restrict access to the S7 server port (typically TCP 102) via firewall rules or ACLs, allowing only explicitly trusted client IP addresses - this directly limits the attacker pool and reduces exposure without affecting legitimate clients. Deploy snap7-based servers in a network-segmented OT DMZ or behind an industrial firewall or data diode to prevent direct internet or corporate-LAN exposure. If write operations to the S7 server are not operationally required, review whether the PerformFunctionWrite code path can be disabled or the server configured in read-only mode, though this is snap7 library-dependent and may require code-level changes. Monitor snap7 server processes for unexpected crashes or connection anomalies as an early indicator of exploitation attempts. Note that firewall segmentation has the trade-off of requiring explicit allow-listing of all legitimate S7 client hosts, which may require operational inventory work in complex OT environments.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today