Live › vulnerability › CVE-2026-115723
Go to dashboardSnap7 through 1.4.3 does not validate the declared total length in BSend, so a malicious active partner can make the passive partner's BRecv copy memory past its buffer. An attacker connecting from the configured peer address can crash or corrupt SCADA, HMI or gateway processes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run Snap7 as a passive partner (server) for industrial protocols such as S7 communication, typically SCADA, HMI or gateway software. Exposure depends on whether an active partner can reach the configured peer address; hosts that do not run Snap7 or do not accept its connections can skip it.
No product ranges from the sources yet.
unknown if the sources do not give a command or file to look at1.4.3: the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
This page as .md · .json · in your agent: get_signal("CVE-2026-115723")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.