EUVD-2026-52152
GHSA-948g-pq52-gmvq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
OOB read via network with no auth; C:L added because reads past buffer boundaries can expose adjacent memory, conflicting with assigned VC:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms_mapping/mms_mapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.6.2 is capable of addressing this issue. Patch name: 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
AnalysisAI
Out-of-bounds read in mz-automation libiec61850 up to version 1.6.1 allows remote unauthenticated attackers to crash the IEC 61850 MMS server process and potentially leak heap or stack memory contents by sending a crafted MMS DataSet access request. The root cause is unconstrained string copy operations in the checkDataSetAccess function, now confirmed fixed in v1.6.2 via bounded copy with a 129-byte limit. A public exploit has been disclosed; however, this vulnerability is not listed in CISA KEV and the CVSS 4.0 score of 6.9 (Medium) reflects limited impact scope confined to availability of the vulnerable system.
Technical ContextAI
libiec61850 is an open-source C library by mz-automation implementing the IEC 61850 standard, which governs communication in electrical substation automation and protection systems. The affected component is the MMS (Manufacturing Message Specification, ISO 9506) server layer, specifically the MMS mapping module at src/iec61850/server/mms_mapping/mms_mapping.c. The checkDataSetAccess function processes incoming MMS requests that reference named DataSets. CWE-125 (Out-of-Bounds Read) is the root cause: prior to the fix, the function called StringUtils_copyStringToBuffer with no length bound, allowing a remote attacker to supply a dataSetRef string longer than the destination buffer, causing reads beyond its allocated boundary. The commit diff (062062daf4cb50c7aa76e01d6fb4d58fc9278a7d) confirms the fix replaced both unbounded calls with StringUtils_copyStringMax(..., 129, ...), capping the copy at 129 bytes. Affected CPE: cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:* covering all releases through 1.6.1.
RemediationAI
Upgrade libiec61850 to version 1.6.2, which is the vendor-confirmed patched release available at https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2. The specific fix is commit 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d (https://github.com/mz-automation/libiec61850/commit/062062daf4cb50c7aa76e01d6fb4d58fc9278a7d), which replaces unbounded StringUtils_copyStringToBuffer calls with StringUtils_copyStringMax bounded to 129 bytes in the checkDataSetAccess function. If upgrading immediately is not feasible, a compensating control is to restrict network access to the MMS port (typically TCP 102) via firewall or ACL to only trusted IEC 61850 clients - this reduces exposure without disabling server functionality but does not eliminate the vulnerability. Blocking all unauthenticated external access to the MMS server is the most effective interim mitigation. Consult the GitHub Security Advisory at https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7v2x-39mw-2979 for additional vendor guidance.
More in Libiec61850
View allAn issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today