The snap7 library up to version 1.4.3 contains a flaw in the TS7Worker::PerformFunctionRead function in src/core/s7_server.cpp, which handles ReadVar requests. This flaw leads to unsafe deserialization, potentially allowing an attacker with local network access to exploit the vulnerability. The issue was reported early to the project, but no response or remediation has been provided. An exploit is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker on the local network to manipulate deserialization in the snap7 service, potentially leading to unauthorized actions or code execution depending on the deserialization context. The published exploit increases the likelihood of active attempts to leverage this flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restrict local network access to the affected service to reduce exposure.