Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115723— Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion

Quick assessment

Affected
davenardella snap7
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Snap7 1.4.3 及更早版本在被动伙伴（passive partner）中存在越界写入漏洞。恶意主动伙伴（active partner）可通过声明未经验证的 BSend 总长度，导致应用程序缓冲区溢出。来自已配置对端地址的攻击者可声明高达 65535 字节的长度，随后发送一个短数据片段，致使 BRecv 函数在缓冲区之外执行 memcpy 操作，从而引发 SCADA、HMI 或网关进程崩溃或数据损坏。

CVSS 7.4 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
davenardella snap7 ≤ 1.4.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115723

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
Source: CVE Program / CVE List V5
Vulnerability Description
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
davenardella snap7 0 ~ 1.4.3 -

II. Public POCs for CVE-2026-115723

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115723

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115723 (1)

Vendor Advisories for CVE-2026-115723 (1)

IV. Related Vulnerabilities

Same product: snap7
Same vendor: davenardella
Same weakness: CWE-787

V. Comments for CVE-2026-115723

No comments yet

Leave a comment