CVE-2026-111280
7.4HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-787
Impact
A rogue or compromised PLC on the network can corrupt memory and crash SCADA, HMI, or gateway processes. The attacker needs network-level access to impersonate an S7 PLC or send malicious S7 responses to a Snap7 client.
Root cause
TSnap7MicroClient::opReadArea() fails to validate the DataLength field in S7 ReadVar responses, triggering a heap/stack out-of-bounds write via memcpy of up to 65535 bytes.
Affected systems
snap7 through 1.4.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Fix & remediation
No fixed version is specified in the advisory; isolate S7 client-to-PLC traffic using network segmentation or firewall rules to prevent untrusted peers from communicating with client services.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
References
- https://github.com/davenardella/snap7
- https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_micro_client.cpp#L136-L150
- https://github.com/davenardella/snap7/issues/31
- https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-tsnap7microclient-opreadarea