EUVD-2026-52152
GHSA-948g-pq52-gmvq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to IEC 61850 MMS server on TCP 102
-
DeliveryCraft oversized DataSet reference string in MMS request
-
ExploitSend malformed MMS DataSet access request
-
ExecutionTrigger unbounded string copy in checkDataSetAccess
-
PersistRead past buffer boundary
-
ImpactCrash server process or leak adjacent memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be running libiec61850 in IEC 61850 server mode with the MMS Request Handler active - this is standard operation for any deployment of the library as a server. No authentication is required per the CVSS 4.0 vector (PR:N), meaning any network-reachable client can trigger the flaw by sending a specially crafted MMS DataSet access request. No non-default configuration is required (AC:L/AT:N). Exploitation is limited to systems where TCP port 102 (MMS) or equivalent is reachable by the attacker; deployments behind strict industrial DMZ firewalls that whitelist only known client IPs are substantially less exposed. Client-mode usage of libiec61850 (not acting as an MMS server) is not affected by this specific code path. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) assigns a base score of 6.9 and limits impact to low availability - consistent with a read-past-buffer that primarily crashes the server process. Notably, the assigned CVSS shows no confidentiality impact (VC:N) despite the vulnerability being an out-of-bounds READ (CWE-125) and the tags including 'Information Disclosure'; this discrepancy is worth flagging - a read overrun may expose adjacent memory, making C:L a defensible independent assessment. No EPSS score was provided in the source data, so exploitation probability cannot be numerically quantified. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. A public proof-of-concept exists (referenced at github.com/gff-cw/information/issues/3), which elevates practical risk above the theoretical baseline. In industrial/OT environments where libiec61850 is used in substation RTUs or protection relays, even a low-severity DoS can disrupt grid monitoring - the real-world risk may be disproportionately higher than the CVSS Medium score implies for critical infrastructure operators. For general enterprise environments, the risk is limited. |
| Exploit ScenarioDerived | A remote attacker with network access to an IEC 61850 MMS server running libiec61850 1.6.1 or earlier sends a crafted MMS DataSet access request containing an oversized dataSetRef string value. The server's checkDataSetAccess function copies this string without bounds checking, reading past the end of the allocated buffer, which causes the server process to crash (DoS) and may expose adjacent memory contents. A public proof-of-concept demonstrating this behavior is available at https://github.com/gff-cw/information/issues/3. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Out-of-bounds read in mz-automation libiec61850 up to version 1.6.1 allows remote unauthenticated attackers to crash the IEC 61850 MMS server process and potentially leak heap or stack memory contents by sending a crafted MMS DataSet access request. The root cause is unconstrained string copy operations in the checkDataSetAccess function, now confirmed fixed in v1.6.2 via bounded copy with a 129-byte limit. A public exploit has been disclosed; however, this vulnerability is not listed in CISA KEV and the CVSS 4.0 score of 6.9 (Medium) reflects limited impact scope confined to availability of the vulnerable system.
RemediationAI
Upgrade libiec61850 to version 1.6.2, which is the vendor-confirmed patched release available at https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2. The specific fix is commit 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d (https://github.com/mz-automation/libiec61850/commit/062062daf4cb50c7aa76e01d6fb4d58fc9278a7d), which replaces unbounded StringUtils_copyStringToBuffer calls with StringUtils_copyStringMax bounded to 129 bytes in the checkDataSetAccess function. If upgrading immediately is not feasible, a compensating control is to restrict network access to the MMS port (typically TCP 102) via firewall or ACL to only trusted IEC 61850 clients - this reduces exposure without disabling server functionality but does not eliminate the vulnerability. Blocking all unauthenticated external access to the MMS server is the most effective interim mitigation. Consult the GitHub Security Advisory at https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7v2x-39mw-2979 for additional vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libiec61850 is an open-source C library by mz-automation implementing the IEC 61850 standard, which governs communication in electrical substation automation and protection systems. The affected component is the MMS (Manufacturing Message Specification, ISO 9506) server layer, specifically the MMS mapping module at src/iec61850/server/mms_mapping/mms_mapping.c. The checkDataSetAccess function processes incoming MMS requests that reference named DataSets. CWE-125 (Out-of-Bounds Read) is the root cause: prior to the fix, the function called StringUtils_copyStringToBuffer with no length bound, allowing a remote attacker to supply a dataSetRef string longer than the destination buffer, causing reads beyond its allocated boundary. The commit diff (062062daf4cb50c7aa76e01d6fb4d58fc9278a7d) confirms the fix replaced both unbounded calls with StringUtils_copyStringMax(..., 129, ...), capping the copy at 129 bytes. Affected CPE: cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:* covering all releases through 1.6.1.
Know when Libiec61850 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
OOB read via network with no auth; C:L added because reads past buffer boundaries can expose adjacent memory, conflicting with assigned VC:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms_mapping/mms_mapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.6.2 is capable of addressing this issue. Patch name: 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Libiec61850
View allAn issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Exploit-DB