Snap7
Monthly
Memory corruption in davenardella snap7 up to version 1.4.3 allows a network-accessible, high-privileged attacker to corrupt memory by supplying a malformed DataLen argument to the TSnap7MicroClient::opUpload function in src/core/s7_micro_client.cpp. The affected library is used for communicating with Siemens S7 PLCs in industrial control environments, making the confidentiality, integrity, and availability of PLC upload sessions potentially compromised. A public proof-of-concept exists via a GitHub issue report, and the project maintainer has not yet responded or issued a patch.
Out-of-bounds write in davenardella snap7 up to version 1.4.3 allows network-authenticated attackers to corrupt memory by supplying a crafted PDULength value during S7 protocol negotiation. The vulnerable function TSnap7Peer::NegotiatePDULength in src/core/s7_peer.cpp fails to enforce bounds on the PDULength argument, enabling writes beyond the allocated buffer boundary. A public proof-of-concept exploit is available on GitHub (issue #17), and the CVSS 4.0 E:P modifier confirms this - elevating practical risk above the medium base score, particularly in OT/ICS deployments where snap7 is commonly used to interface with Siemens S7 PLCs.
The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to No and S7 writes a var function, the Snap7 server will be. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Memory corruption in davenardella snap7 up to version 1.4.3 allows a network-accessible, high-privileged attacker to corrupt memory by supplying a malformed DataLen argument to the TSnap7MicroClient::opUpload function in src/core/s7_micro_client.cpp. The affected library is used for communicating with Siemens S7 PLCs in industrial control environments, making the confidentiality, integrity, and availability of PLC upload sessions potentially compromised. A public proof-of-concept exists via a GitHub issue report, and the project maintainer has not yet responded or issued a patch.
Out-of-bounds write in davenardella snap7 up to version 1.4.3 allows network-authenticated attackers to corrupt memory by supplying a crafted PDULength value during S7 protocol negotiation. The vulnerable function TSnap7Peer::NegotiatePDULength in src/core/s7_peer.cpp fails to enforce bounds on the PDULength argument, enabling writes beyond the allocated buffer boundary. A public proof-of-concept exploit is available on GitHub (issue #17), and the CVSS 4.0 E:P modifier confirms this - elevating practical risk above the medium base score, particularly in OT/ICS deployments where snap7 is commonly used to interface with Siemens S7 PLCs.
The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to No and S7 writes a var function, the Snap7 server will be. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.