Deserialization Flaw in Snap7 Library

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: VulDB

Description

A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the component ReadVar Request Handler. This manipulation causes deserialization. The attack requires access to the local network. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-15105

Affected Vendors & Products

Vendor	Product	Version / Range
davenardella	snap7	to 1.4.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in the davenardella snap7 software up to version 1.4.3, specifically in the TS7Worker::PerformFunctionRead function within the ReadVar Request Handler component. It involves a manipulation that causes deserialization, which means that crafted input can be used to exploit the way data is processed. The attack requires access to the local network, and an exploit has already been published.

Impact Analysis

The vulnerability can allow an attacker with local network access to manipulate the deserialization process in the affected software. This could potentially lead to unauthorized actions or compromise of the system running the vulnerable component. The CVSS v3.1 score of 6.3 indicates a medium severity impact, including possible impacts on confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-15105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70