EUVD-2026-51361
GHSA-gqw6-mwcf-3xwh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth (PR:N); one-byte heap over-read gives low confidentiality and potential parser crash gives low availability; scope unchanged.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.
AnalysisAI
Out-of-bounds read in mz-automation/lib60870 allows unauthenticated remote attackers to leak one byte of heap memory and potentially crash the parsing process by sending a crafted IEC 60870-5-104 I-frame. The vulnerability triggers when a declared ASDU object count exceeds the actual data present in the message buffer, causing InformationObject_ParseObjectAddress to read one byte beyond the allocated heap region. Disclosed via CISA ICS Advisory ICSA-26-211-11 with no public exploit identified at time of analysis.
Technical ContextAI
lib60870 is an open-source C library by mz-automation implementing the IEC 60870-5-101 and IEC 60870-5-104 telecontrol protocols, widely used in SCADA and power-grid infrastructure. IEC 60870-5-104 transmits I-frames (information transfer frames) over TCP, each carrying an Application Service Data Unit (ASDU) with a declared count of Information Objects. The root cause (CWE-125, Out-of-bounds Read) is a missing or insufficient bounds check in InformationObject_ParseObjectAddress: when the declared object count in the ASDU header exceeds the number of objects that actually fit within the heap-allocated message buffer, the parser advances its read pointer past the buffer's terminal byte. No CPE identifier was provided in the input, but the affected codebase is traceable to github.com/mz-automation/lib60870 per GHSA-7v97-jmwv-w5j7.
RemediationAI
The primary remediation is to upgrade lib60870 to the patched version identified in GHSA-7v97-jmwv-w5j7 (https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7); an exact fix version was not included in the provided input data, so operators should consult the advisory directly. CISA ICS Advisory ICSA-26-211-11 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11) should also be reviewed for vendor-specific guidance if lib60870 is embedded in a commercial product. Where an immediate patch cannot be applied, compensating controls include restricting TCP access to IEC 60870-5-104 ports (default 2404) via firewall ACLs to trusted engineering workstations and control-center IP ranges only - this eliminates the network attack surface but does not mitigate insider or lateral-movement threats. Network-level deep packet inspection capable of validating ASDU object-count fields against actual payload length can detect and drop malformed I-frames without requiring library changes, though this adds processing latency and may affect real-time control performance.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today