CVE-2026-111280
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
77/100
Published: 2026-10-15
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
Present
VC:
None
VI:
High
VA:
High
Description
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| davenardella | snap7 | 0 |