EUVD-2026-51654
GHSA-4pg7-2q5x-32w4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GOOSE is non-routable Layer-2 multicast, so AV:A not AV:N; no auth or interaction needed (PR:N/UI:N), and impact is chiefly forged control (I:H/A:H) with limited confidentiality (C:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame.
AnalysisAI
Authentication bypass in libiec61850 v1.6's GOOSE receiver (parseGoosePayload() in goose_receiver.c) lets an attacker on the substation network replay a captured GOOSE frame to be accepted as authentic, defeating the intended message authentication. The library implements IEC 61850 protocols used in electrical-grid protection and automation, so spoofed GOOSE traffic can drive false relay/breaker actions. Publicly available exploit code exists (PoC repo and SSVC-rated PoC), but there is no CISA KEV listing and EPSS is low at 0.26%, indicating no confirmed widespread exploitation.
Technical ContextAI
libiec61850 (mz-automation) is a widely-referenced open-source C library implementing the IEC 61850 stack for OT/ICS substation automation, including GOOSE (Generic Object Oriented Substation Event), a Layer-2 Ethernet multicast protocol used for fast peer-to-peer transmission of protection/control events between intelligent electronic devices (IEDs). The flaw is in parseGoosePayload() in /goose/goose_receiver.c, which processes inbound GOOSE APDUs. CWE-284 (Improper Access Control) is the root-cause class: the receiver fails to properly validate/authenticate frame origin or freshness (StNum/SqNum/timestamp state), so a previously captured legitimate frame is treated as trusted. Because GOOSE has no native cryptographic authentication in most deployments and relies on the stack to enforce trust/replay checks, a parsing/validation gap directly translates into acceptance of forged or replayed control data.
RemediationAI
No vendor-released patch or fixed version is identified at time of analysis, so track the upstream repository (https://github.com/mz-automation/libiec61850) for a tagged release addressing parseGoosePayload() before rebuilding. As compensating controls: segment and isolate the GOOSE traffic to a dedicated protection/process VLAN and enforce strict Layer-2 access control so untrusted hosts cannot inject frames onto that segment (trade-off: requires managed switches and careful IED port mapping); enable IEC 62351-6 authentication/signing for GOOSE where the IEDs support it to defeat replay/forgery (trade-off: added latency and interoperability testing, and not all field devices support it); deploy GOOSE-aware monitoring/IDS to alert on StNum/SqNum regressions or duplicate frames that indicate replay (detective, not preventive); and physically restrict access to substation switch ports. Review the advisories at https://vuldb.com/vuln/385150 and https://nvd.nist.gov/vuln/detail/CVE-2026-52134 for updates.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today