CVE-2026-15105: snap7 Out-of-Bounds Write in ReadVar Handler – Local Network Exploitation

Technical summary

The vulnerability resides in the ReadVar Request Handler component of snap7's core server implementation. Specifically, the TS7Worker::PerformFunctionRead function in src/core/s7_server.cpp fails to properly validate buffer boundaries before writing parsed request data, resulting in an out-of-bounds write condition (CWE-787). This is a classic stack or heap buffer overflow triggered by crafted S7 protocol messages. The attack surface is limited to clients on the same network segment—remote exploitation over the Internet is not possible. The CVSS 3.1 score of 6.3 (MEDIUM) reflects the local network requirement but acknowledges impact to confidentiality, integrity, and availability.

Business impact

Organizations running snap7-based applications as industrial control system (ICS) gateways, data collectors, or diagnostic tools face operational risk. A successful exploit could crash the service, disrupt communication with PLCs, or in worst-case scenarios provide a foothold for lateral movement within a production network. While the local-network-only requirement limits immediate threat scope, it remains critical for facilities where untrusted devices or contractors have network access. The lack of vendor response creates uncertainty around patch timelines and may force workarounds or service isolation.

Affected systems

All snap7 releases up to and including version 1.4.3 are affected. This includes any application or integration that bundles or calls snap7 for S7 protocol communication. Common deployments include historical data logging systems, SCADA dashboards, PLC configuration tools, and ICS bridges. Users running older versions are at highest risk; those on the latest 1.4.3 release are also vulnerable pending a security update.

Exploitability

Exploitation is practical and no longer theoretical—proof-of-concept code is publicly available. An attacker must be on the same local network as the snap7 service (Ethernet, WiFi, or adjacent VLAN) and able to send crafted S7 ReadVar messages. No authentication or user interaction is required. The simplicity of the attack vector and availability of PoC significantly elevate risk for exposed snap7 instances, though the geographic and network proximity requirement constrains the adversary pool in most environments.

Remediation

Immediate mitigation options are limited because the vendor has not released a patched version. Recommended actions: (1) If feasible, upgrade snap7 to a patched version once available—monitor the project repository and security advisories closely; (2) Isolate snap7 services to trusted network segments using firewall rules, network segmentation, or air-gapping; (3) Restrict network access to snap7 ports to only authorized PLC communication sources; (4) Monitor for and log any unusual S7 protocol traffic; (5) Evaluate alternative, actively maintained S7 libraries if long-term support is critical. Organizations unable to patch should prioritize network isolation over application-level fixes.

Patch guidance

No official patch has been released as of the vulnerability publication date. The snap7 project was notified early but has not yet responded with a security update or patch timeline. Verify against the davenardella/snap7 GitHub repository and official documentation for any subsequent releases. When a patch is made available, test it thoroughly in a non-production environment before deploying to operational PLC networks, as any change to the protocol handler could affect compatibility with existing deployments.

Detection guidance

Monitor network traffic for malformed or oversized S7 ReadVar requests targeting snap7 ports (typically TCP 102 or configured alternatives). Log any service crashes or unexpected restarts of snap7-based applications, as these may indicate exploitation attempts. Implement process monitoring and memory protection (ASLR, DEP/NX) on systems running snap7 to limit silent exploitation. Intrusion detection rules targeting malformed S7 protocol frames or buffer overflow patterns can detect active exploitation. Baseline normal S7 traffic volumes and frame sizes to identify anomalies.

Why prioritize this

Although the CVSS score is MEDIUM (6.3), this vulnerability warrants higher priority in ICS and manufacturing environments due to its active exploitation, public PoC availability, and the vendor's unresponsive posture. The local-network-only attack vector is not a weakness in controlled ICS networks—it is the baseline threat model. The combination of memory corruption (potential code execution), lack of a patch, and common deployment in critical systems elevates practical risk above the numerical score suggests. Organizations should treat this as a near-term remediation or isolation task.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects an out-of-bounds write affecting confidentiality, integrity, and availability with a local attack vector and no privilege or user interaction required. The score appropriately penalizes the network boundary requirement (AV:A) but does not downweight the exploitability of memory corruption flaws or the vendor's lack of response. In ICS contexts, the practical risk is often higher than the base CVSS reflects, as availability of control systems is paramount and local networks in factories are frequently more permeable than assumed in generic IT environments.

Frequently asked questions