CVE-2026-15105
Publication date 9 July 2026
Last updated 9 July 2026
Ubuntu priority
Description
A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the component ReadVar Request Handler. This manipulation causes deserialization. The attack requires access to the local network. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| snap7 | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Severity score breakdown
CVSS version:
Base score
2.1 · Low
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Base score
6.3 · Medium
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-15105
- https://github.com/davenardella/snap7/
- https://github.com/davenardella/snap7/issues/16
- https://github.com/user-attachments/files/28681740/poc.zip
- https://vuldb.com/cve/CVE-2026-15105
- https://vuldb.com/submit/851026
- https://vuldb.com/vuln/376946
- https://vuldb.com/vuln/376946/cti