EUVD-2026-51362
GHSA-gfjj-vr9m-mw6f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth or interaction required; one-byte heap read yields low confidentiality loss and potential crash yields low availability impact.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.
AnalysisAI
Out-of-bounds heap read in mz-automation's lib60870 library exposes ICS/SCADA systems to unauthenticated remote exploitation via a crafted IEC 60870-5-104 I-frame. An attacker sending a C_TS_NA_1 ASDU with an inflated object count triggers TestCommand_getFromBuffer to read one byte past the end of a heap-allocated buffer, producing partial heap memory disclosure and potential availability disruption. CISA ICS-CERT has published advisory ICSA-26-211-11; no active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Technical ContextAI
lib60870 is an open-source C/C++ library by mz-automation implementing the IEC 60870-5-104 telecontrol protocol, which is the TCP/IP adaptation of IEC 60870-5-101 and is ubiquitous in power-grid SCADA, substation automation, and industrial control communication. TypeID 104 (C_TS_NA_1, Test Command No Additional qualifier) is one of the Application Service Data Unit (ASDU) types parsed in the library. The function TestCommand_getFromBuffer deserializes this ASDU type from a heap-allocated buffer; when an attacker crafts an I-frame with an inflated information-object count field, the parser iterates beyond the buffer boundary by one byte. CWE-125 (Out-of-Bounds Read) is the root cause class: the library fails to validate that the declared object count is consistent with the actual buffer length before indexing into it, a classic off-by-one in a length-prefixed binary protocol parser.
RemediationAI
Apply the patched release of lib60870 once confirmed in the GitHub Security Advisory GHSA-g3w7-x5rx-83xm; a specific fixed version number is not stated in the available data and should be verified directly at https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm before upgrading. Until a patch is applied, restrict network access to the IEC 60870-5-104 service port (default TCP 2404) to known and authorized master stations using firewall rules or network ACLs - this reduces the attack surface to authenticated peers and is a standard ICS defense-in-depth measure with minimal operational impact. If the C_TS_NA_1 (TypeID 104 Test Command) message type is not operationally required, consider filtering or rejecting frames with that TypeID at a protocol-aware intermediary such as an ICS-aware firewall or DataDiode; note this may break interoperability with systems that use test-command heartbeat mechanisms. Refer to CISA advisory ICSA-26-211-11 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11 for vendor-specific mitigations.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today