EUVD-2026-48398Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IEC-104 endpoint over network
-
DeliveryCraft malformed ASDU/APDU frame
-
ExploitSend frame to lib60870 parser
-
ExecutionTrigger out-of-bounds read (CWE-125)
-
PersistCrash telecontrol process
-
ImpactDenial of service on SCADA link
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a service built on lib60870 that accepts and parses IEC 60870-5-101/104 protocol frames (for IEC-104, a TCP listener typically on port 2404); the attacker must be able to deliver a malformed ASDU/APDU to that parser. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no special attack requirements, and no user interaction are needed against a reachable endpoint. The principal limiting factor is exposure: IEC 60870-5 endpoints are normally deployed on segmented OT networks rather than the public internet, so realistic exploitation depends on the attacker first gaining access to the control network or the endpoint being improperly exposed. The exact affected versions are not enumerated, so whether a given deployment is vulnerable must be verified against the advisory. |
| Impact | The CVSS 4.0 base score is 8.8 (High) driven by a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high availability impact (VA:H) - a realistic profile for a network-exposed IEC 60870-5-104 endpoint. However, the concrete impact is a denial of service (crash of the parser), not code execution, so the integrity impact is None and confidentiality is only Low. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from the data at hand; the absence of a KEV entry means there is no confirmed active exploitation. The confidentiality tag (Information Disclosure) and Buffer Overflow tag suggest the read may leak adjacent memory, but the description only confirms a crash - treat any information-disclosure claim as inferred, not confirmed. Net: for ICS operators exposing IEC-104 this is a genuine availability priority, but it is a DoS rather than an RCE, so it should be prioritized behind any code-execution flaws on the same assets. |
| Exploit ScenarioDerived | An attacker with network access to a device running lib60870's IEC 60870-5-104 server sends a single crafted APDU/ASDU with a malformed length or type field over TCP (typically port 2404). The parser performs an out-of-bounds read and the telecontrol process crashes, dropping SCADA communication with the affected RTU or gateway. No authentication or user interaction is required (PR:N/UI:N), and no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
RemediationAI
No vendor-released patched version is identified in the provided data, so the fixed version cannot be cited here - consult the CISA ICS advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-07) and the MZ Automation lib60870 upstream repository for the corrected release and update all deployments to it once published. As compensating controls until patched: restrict network reachability of the IEC 60870-5-104 TCP endpoint (default TCP port 2404) using firewall rules or ACLs so that only known master/RTU peers can connect, which directly removes the AV:N exposure but requires an accurate inventory of legitimate peers; place the affected devices behind a segmented ICS/OT network or VPN and block IEC-104 traffic at the IT/OT boundary, at the cost of added latency and management overhead; and enable protocol-aware monitoring/IDS on IEC-104 links to detect malformed ASDUs, noting this detects but does not prevent the crash. Avoid exposing lib60870 endpoints directly to the internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
lib60870 implements the IEC 60870-5-101 (serial) and IEC 60870-5-104 (TCP/IP) telecontrol protocols widely used in electric utility, water, and other critical-infrastructure SCADA deployments for master/RTU communication. The root cause is an out-of-bounds read (CWE-125): during parsing of an incoming ASDU/APDU the library reads memory outside the bounds of the intended buffer, likely because a length or type field in the received frame is not validated against the actual received payload size. Because CWE-125 reads adjacent memory, it can both crash the process (availability) and, per the vendor tags, potentially disclose small amounts of adjacent memory (the VC:L confidentiality impact), though the primary documented effect is a parsing-process crash.
Know when Lib60870 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated malformed-frame parsing (AV:N/AC:L/PR:N/UI:N); primary impact is a parser crash (A:H) with limited memory-read disclosure (C:L) and no integrity impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.
Executive ViewAI
MZ Automation's lib60870 protocol library, deployed in SCADA and critical infrastructure control systems globally, is vulnerable to remote denial-of-service attacks requiring no authentication or user interaction. No public exploit identified at time of analysis, but attackers with network access could crash system processes, disrupting operational availability-a material business continuity risk for utilities, water systems, industrial facilities, and other ICS-dependent organizations. The straightforward network-based attack vector and widespread library deployment create urgent need for immediate defensive measures.
Implement network segmentation restricting IEC 60870-5-104 protocol access to trusted internal networks; deploy IDS/IPS signatures to detect and block malformed frames targeting lib60870; configure connection rate limiting and process monitoring on affected SCADA systems; establish real-time alerting for service crashes and abnormal terminations; develop and regularly test incident response procedures specific to infrastructure denial-of-service scenarios; monitor MZ Automation security advisories and apply patches immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET
An issue was discovered in lib60870 2.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in lib60870 v2.3.2. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexit
GitHub PoC
Exploit-DB