What is the CVSS score of CVE-2026-51219?

CVE-2026-51219 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of lib60870 are affected by CVE-2026-51219?

lib60870 versions 2.3.3-2.3.6 contain a heap buffer overflow affecting IEC 60870-5 protocol implementations in SCADA and industrial control systems.

How to fix or mitigate CVE-2026-51219?

Within 24 hours: conduct a complete asset inventory of all lib60870 deployments across SCADA, ICS, and industrial networks, document affected versions 2.3.3-2.3.6, and verify current patch status with system owners. Within 7 days: isolate affected systems from untrusted networks using network segmentation, implement strict ingress filtering on IEC 60870-5 protocol ports (typically TCP 2404), and deploy network-based intrusion detection rules to monitor for malformed ASDU messages. Within 30 days: monitor vendor advisory channels for patch availability and establish a rapid deployment plan; evaluate vendor alternatives or interim updates that may provide mitigation, and conduct red-team testing of current network controls to validate effectiveness against proof-of-concept attacks.

lib60870 CVE-2026-51219

EUVD-2026-40245 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-29 mitre

GHSA-27wh-38h4-pr2j

Buffer Overflow Denial Of Service Heap Overflow N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable IEC 60870-5-104 endpoint requires no authentication; impact is strictly availability-only with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 14:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 14:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 14:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 14:23 NVD

6.5 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jul 22, 2026 - 20:08 vuln.today

CVE Published

Jun 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service (DoS) via a crafted payload.

AnalysisAI

Heap buffer overflow in lib60870 versions 2.3.3 through 2.3.6 allows remote unauthenticated attackers to crash processes handling IEC 60870-5 protocol traffic by sending crafted Application Service Data Unit (ASDU) messages. The overflow occurs in the HighPriorityASDUQueue_hasUnconfirmedIMessages function, which manages high-priority message queuing in the IEC 60870-5-104 telecontrol protocol stack - making this particularly relevant to SCADA and industrial control system deployments where availability is operationally critical. No active exploitation is confirmed by CISA KEV; however, SSVC indicates a proof-of-concept exists, and EPSS of 0.18% (8th percentile) suggests minimal current exploitation activity.

Technical ContextAI

lib60870 is an open-source C library maintained by mz-automation that implements the IEC 60870-5 protocol family (including -101 and -104 variants), used extensively in energy grid automation, SCADA systems, and industrial telecontrol equipment for communication between control centers and remote terminal units (RTUs). The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), occurring specifically in HighPriorityASDUQueue_hasUnconfirmedIMessages - a function responsible for checking unconfirmed I-format messages in the high-priority ASDU queue. Insufficient bounds validation on heap-allocated buffer operations during message processing allows an attacker-controlled payload to write beyond the allocated buffer, corrupting heap metadata and triggering a process crash. The affected CPE is listed as cpe:2.3:a:n/a:n/a, indicating this library lacks a formally registered NVD CPE entry, reflecting its status as a community-maintained open-source dependency rather than a tracked commercial product.

RemediationAI

Upgrade lib60870 to a release beyond version 2.3.6; check https://github.com/mz-automation/lib60870/releases for the latest available version containing the fix. The upstream issue tracker entry at https://github.com/mz-automation/lib60870/issues/196 should be consulted to confirm patch status and identify the exact fixing commit or tagged release, as no specific patched version was confirmed in the available intelligence. As a compensating control where upgrading is not immediately feasible, restrict network access to the IEC 60870-5-104 service port (default TCP 2404) using firewall rules or network ACLs to permit only trusted SCADA masters and RTUs - this directly reduces the attack surface to trusted network segments and counteracts the AV:N/PR:N attack vector. Note that port-level blocking will disrupt legitimate telecontrol communication and must be coordinated with operations teams before implementation. Deploying protocol-aware deep packet inspection capable of validating IEC 60870-5 ASDU structure can provide an additional detection or blocking layer.