CVE-2025-14673

CriticalCVSS 9.8/10Last modified Sep 28, 2026

Description

A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7_rs::client::S7Client::as_ct_write of the file /tests/snap7-rs/src/client.rs. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-122

Affected software

Vendor	Product	Versions
gmg137	snap7-rs	1.142.0; 1.142.1

References

https://gitee.com/gmg137/snap7-rs/
https://gitee.com/gmg137/snap7-rs/issues/ID2H74Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.336402Permissions Required, VDB Entry
https://vuldb.com/?id.336402Third Party Advisory, VDB Entry

Timeline

Published: Dec 14, 2025
Last modified: Sep 28, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-146746.3A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file CVE-2025-146757.2The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file CVE-2025-14687.5An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA S CVE-2025-146843.3IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages CVE-2025-146876.5IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforce CVE-2025-146885.3IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authentica CVE-2025-146896.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial CVE-2025-14697.5Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This i CVE-2025-146916.1A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manip CVE-2025-146926.1A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulatio CVE-2025-146936.2A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulati CVE-2025-146944.7A vulnerability was found in ketr JEPaaS up to 7.2.8. This impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. P