Available versions of Snap7 up to 1.4.3 contain an out-of-bounds write (CWE-787) in TSnap7MicroClient::opReadArea(). The vulnerability stems from an unchecked DataLength field, enabling malicious S7 peers to send crafted ReadVar responses that trigger a memcpy of up to 65535 bytes into client buffers. The resulting memory corruption can crash SCADA, HMI, or gateway processes and potentially alter program state, causing loss of availability and reliability in industrial automation environments.

The affected product is Snap7 from davenardella, specifically all releases up to and including version 1.4.3. Devices or systems that employ Snap7 client integration with PLCs may be vulnerable if they have not yet upgraded to a patched version.

The CVSS base score of 8.3 indicates a high severity, and the EPSS score of < 1% suggests a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a rogue or impersonated PLC connecting over the network to a Snap7 client, sending a malicious ReadVar response that causes the overflow. There are no prerequisite conditions beyond network connectivity to the vulnerable client.