Which versions of lib60870 are affected by CVE-2026-16002?

MZ Automation's lib60870 protocol library, deployed in SCADA and critical infrastructure control systems globally, is vulnerable to remote denial-of-service attacks requiring no authentication or…

How to fix or mitigate CVE-2026-16002?

Within 24 hours, identify all systems running MZ Automation's lib60870 library and map their network exposure, prioritizing assets supporting critical infrastructure operations and any systems with internet or remote access. Within 7 days, deploy network segmentation to isolate IEC 60870-5-104 protocol traffic to trusted networks, implement packet filtering on port 2404 (standard IEC 104 port), and configure intrusion detection/prevention systems (IDS/IPS) with rules to detect and block malformed protocol frames. Within 30 days, establish continuous monitoring and alerting for abnormal process terminations on affected systems, regularly review MZ Automation security advisories for patch releases, conduct incident response tabletop exercises for potential denial-of-service scenarios on critical SCADA assets, and execute patch deployment immediately upon vendor release.

lib60870 CVE-2026-16002

Q: What is the CVSS score of CVE-2026-16002?

CVE-2026-16002 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48398 HIGH

Out-of-bounds Read (CWE-125)

2026-07-23 icscert

Buffer Overflow Denial Of Service Information Disclosure Lib60870 Mz Automation

8.8

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Remote unauthenticated malformed-frame parsing (AV:N/AC:L/PR:N/UI:N); primary impact is a parser crash (A:H) with limited memory-read disclosure (C:L) and no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:32 vuln.today

CVSS changed

Jul 23, 2026 - 21:23 NVD

8.2 (HIGH) 8.8 (HIGH)

CVE Published

Jul 23, 2026 - 20:57 cve.org

HIGH 8.8

DescriptionCVE.org

The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.

AnalysisAI

Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

lib60870 implements the IEC 60870-5-101 (serial) and IEC 60870-5-104 (TCP/IP) telecontrol protocols widely used in electric utility, water, and other critical-infrastructure SCADA deployments for master/RTU communication. The root cause is an out-of-bounds read (CWE-125): during parsing of an incoming ASDU/APDU the library reads memory outside the bounds of the intended buffer, likely because a length or type field in the received frame is not validated against the actual received payload size. Because CWE-125 reads adjacent memory, it can both crash the process (availability) and, per the vendor tags, potentially disclose small amounts of adjacent memory (the VC:L confidentiality impact), though the primary documented effect is a parsing-process crash.

RemediationAI

No vendor-released patched version is identified in the provided data, so the fixed version cannot be cited here - consult the CISA ICS advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-07) and the MZ Automation lib60870 upstream repository for the corrected release and update all deployments to it once published. As compensating controls until patched: restrict network reachability of the IEC 60870-5-104 TCP endpoint (default TCP port 2404) using firewall rules or ACLs so that only known master/RTU peers can connect, which directly removes the AV:N exposure but requires an accurate inventory of legitimate peers; place the affected devices behind a segmented ICS/OT network or VPN and block IEC-104 traffic at the IT/OT boundary, at the cost of added latency and management overhead; and enable protocol-aware monitoring/IDS on IEC-104 links to detect malformed ASDUs, noting this detects but does not prevent the crash. Avoid exposing lib60870 endpoints directly to the internet.