{"id":"CVE-2026-115723","kind":"vulnerability","aliases":["CVE-2026-115723"],"related":[],"title":"Snap7: out-of-bounds write lets a peer crash or corrupt SCADA processes","description":"Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.","summary":"Snap7 through 1.4.3 does not validate the declared total length in BSend, so a malicious active partner can make the passive partner's BRecv copy memory past its buffer. An attacker connecting from the configured peer address can crash or corrupt SCADA, HMI or gateway processes.","severity":"high","cvss":8.3,"epss":0.00617,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmi","industrial-control","other","s7-protocol","scada","self-hosted","snap7"],"not_affected_if":["no-snap7-passive-partner","peer-address-restricted"],"how_to_check":"- Check the Snap7 version in use: `unknown` if the sources do not give a command or file to look at\n- Confirm whether the application runs the Snap7 passive partner (server) and which peer addresses it accepts","fix":"- Upgrade Snap7 past `1.4.3`: the fixed version is unknown from the sources\n- Restrict which peer addresses may connect to the passive partner until a fix is applied","status":"open","published_at":"2026-10-23T12:18:12+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:02:03+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:02:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Snap7 past `1.4.3`: the fixed version is unknown from the sources\n- Restrict which peer addresses may connect to the passive partner until a fix is applied","reach":"network","title":"Snap7: out-of-bounds write lets a peer crash or corrupt SCADA processes","impact":"high","summary":"Snap7 through 1.4.3 does not validate the declared total length in BSend, so a malicious active partner can make the passive partner's BRecv copy memory past its buffer. An attacker connecting from the configured peer address can crash or corrupt SCADA, HMI or gateway processes.","category":"other","nicknames":[],"who_cares":["snap7","scada","hmi","industrial-control","s7-protocol","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote peer crashes or corrupts SCADA, HMI or gateway processes","analyst_note":"Find the fixed Snap7 version and any vendor advisory; the NVD entry in the sources does not name them.","how_to_check":"- Check the Snap7 version in use: `unknown` if the sources do not give a command or file to look at\n- Confirm whether the application runs the Snap7 passive partner (server) and which peer addresses it accepts","needs_analyst":true,"not_affected_if":["no-snap7-passive-partner","peer-address-restricted"],"who_is_affected":"Systems that run Snap7 as a passive partner (server) for industrial protocols such as S7 communication, typically SCADA, HMI or gateway software. Exposure depends on whether an active partner can reach the configured peer address; hosts that do not run Snap7 or do not accept its connections can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3364,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115723':17A,20A '-2026':16A,19A '1.4.3':36B,82C '65535':123C 'activ':49B,99C 'address':70B,118C 'allow':96C 'applic':103C 'attack':64B,112C 'bound':5A,88C 'brecv':57B,131C 'bsend':45B,109C 'buffer':62B,104C,136C 'byte':124C 'caus':130C 'configur':68B,116C 'connect':65B,113C 'contain':83C 'control':24B 'copi':58B 'corrupt':12A,74B,140C 'crash':10A,72B,138C 'cve':15A,18A 'declar':41B,106C,120C 'fragment':129C 'gateway':78B,144C 'hmi':21B,76B,142C 'host':32B 'industri':23B 'industrial-control':22B 'length':43B,111C 'let':7A 'make':52B 'malici':48B,98C 'memcpi':133C 'memori':59B 'out-of-bound':2A,85C 'overflow':102C 'partner':50B,55B,94C,100C 'passiv':54B,93C 'past':60B,134C 'peer':9A,69B,117C 'process':14A,79B,145C 'protocol':28B 's7':27B 's7-protocol':26B 'scada':13A,29B,75B,141C 'self':31B 'self-host':30B 'send':126C 'short':128C 'snap7':1A,33B,34B,80C 'total':42B,110C 'unvalid':108C 'valid':39B 'vulner':90C 'write':6A,89C","nicknames":[],"mitigations":[],"who_affected":"Systems that run Snap7 as a passive partner (server) for industrial protocols such as S7 communication, typically SCADA, HMI or gateway software. Exposure depends on whether an active partner can reach the configured peer address; hosts that do not run Snap7 or do not accept its connections can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115723","severity":null,"published_at":"2026-10-23T12:18:12+00:00","modified_at":"2026-10-23T15:17:30+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115723","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115723","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}