CVE-2026-15105: Snap7 Deserialization Vulnerability

CVE-2026-15105 Overview

CVE-2026-15105 is a deserialization vulnerability affecting davenardella snap7 up to version 1.4.3, an open-source communication library for Siemens S7 programmable logic controllers (PLCs). The flaw resides in the TS7Worker::PerformFunctionRead function within src/core/s7_server.cpp, part of the ReadVar Request Handler component. Attackers with adjacent network access can trigger unsafe deserialization by sending crafted requests. A public proof-of-concept has been released, and the project maintainers have not yet responded to the issue report.

Critical Impact
Adjacent-network attackers can exploit unsafe deserialization in the snap7 server component to affect confidentiality, integrity, and availability of industrial control system communications.

Affected Products

davenardella snap7 versions up to and including 1.4.3
Applications and industrial systems embedding the snap7 server library
Deployments exposing the S7 protocol server on operational technology networks

Discovery Timeline

2026-07-08 - CVE-2026-15105 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15105

Vulnerability Analysis

The vulnerability is classified under [CWE-20] Improper Input Validation and manifests as insecure deserialization within the snap7 server implementation. When the server processes an incoming ReadVar S7 protocol request, TS7Worker::PerformFunctionRead in src/core/s7_server.cpp deserializes attacker-controlled data without sufficient validation. This allows a network-adjacent attacker to influence internal object state during parsing.

Snap7 is widely used to interface with Siemens S7-300, S7-400, S7-1200, and S7-1500 PLCs. Because the library is embedded in bridge applications, HMI software, and custom SCADA gateways, exploitation can affect industrial data flows. A proof-of-concept archive has been published as an attachment on the project's GitHub issue tracker.

Root Cause

The root cause is improper validation of length and type fields inside serialized S7 protocol structures processed by the ReadVar handler. The handler consumes attacker-supplied bytes and reconstructs internal objects without enforcing bounds or type constraints. This deserialization pattern permits state corruption during request handling.

Attack Vector

Exploitation requires access to the local or adjacent network hosting the snap7 server. The attacker sends a malformed S7 ReadVar request to the listening service, typically on TCP port 102 (ISO-on-TCP / RFC 1006). No authentication or user interaction is required. Technical details are available in the GitHub Issue Discussion and the VulDB CVE-2026-15105 entry.

Detection Methods for CVE-2026-15105

Indicators of Compromise

Unexpected TCP connections to port 102 (ISO-TSAP) from unauthorized hosts on OT or engineering networks
Crashes, restarts, or abnormal memory patterns in processes linking against the snap7 server library
S7 ReadVar requests containing malformed length fields or oversized item descriptors
Presence of the published poc.zip payload contents traversing east-west network segments

Detection Strategies

Deploy deep packet inspection rules for the S7Comm protocol that validate ReadVar item counts and address ranges
Monitor process integrity for services embedding snap7, alerting on unexpected termination or memory anomalies
Correlate network telemetry from OT segments with process behavior on hosts running snap7-based applications

Monitoring Recommendations

Enable protocol-aware logging on OT firewalls and industrial IDS platforms for S7 traffic
Baseline legitimate snap7 client sources and alert on new or unauthorized initiators of ReadVar requests
Track upstream commits on the snap7 GitHub repository for maintainer response and patch availability

How to Mitigate CVE-2026-15105

Immediate Actions Required

Inventory all systems and applications that link against or embed the snap7 library at versions up to 1.4.3
Restrict access to snap7 server endpoints using network segmentation and strict allow-lists at OT/IT boundaries
Disable exposed snap7 server instances that are not strictly required for production operations
Monitor the GitHub Issue Discussion for an official maintainer response

Patch Information

No official patch is available at the time of publication. The project has been notified through the issue tracker but has not yet responded. Track the snap7 GitHub repository for future releases addressing the ReadVar handler.

Workarounds

Place snap7-based services behind an industrial firewall that enforces S7Comm protocol validation and drops malformed ReadVar requests
Bind snap7 server listeners to loopback or dedicated management interfaces where feasible, eliminating adjacent-network exposure
Apply zero-trust controls between engineering workstations and PLC gateways, requiring VPN or jump-host access
Rebuild dependent applications against a locally patched snap7 fork with input validation added to TS7Worker::PerformFunctionRead

bash

# Configuration example: restrict access to snap7 server (TCP/102) via iptables
iptables -A INPUT -p tcp --dport 102 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 102 -j DROP