Which versions of MMS Protocol Stack are affected by CVE-2026-63550?

A denial-of-service vulnerability (CVE-2026-63550, CVSS 7.1) in IEC 61850 MMS protocol implementations allows authenticated attackers to crash the MMS process via malformed TCP/102 messages,…. A patch is available.

How to fix or mitigate CVE-2026-63550?

Within 24 hours: identify all systems implementing IEC 61850 MMS and restrict TCP port 102 access to trusted internal networks only; disable external connectivity where feasible. Within 7 days: implement network-level access controls and egress filtering for MMS traffic, establish session monitoring baselines to detect anomalous activity, and document all MMS-dependent systems and their operational criticality. Within 30 days: subscribe to vendor security advisories, develop and test a patch deployment plan in staging, and enhance MMS process monitoring with automated restart capabilities to minimize downtime from potential DoS events.

MMS Protocol Stack CVE-2026-63550

Q: What is the CVSS score of CVE-2026-63550?

CVE-2026-63550 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51357 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 ics-cert@hq.dhs.gov

GHSA-mgh9-x48v-5vx9

Buffer Overflow Information Disclosure

7.1

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable BER decoder (AV:N/AC:L) but needs an established MMS session (PR:L); impact is a process crash only, so C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 01:16 EUVD

Analysis Generated

Jul 30, 2026 - 23:35 vuln.today

CVE Published

Jul 30, 2026 - 23:16 cve.org

HIGH 7.1

DescriptionCVE.org

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position incorrectly, leading to a heap out-of-bounds read. This condition causes the MMS handling process to terminate unexpectedly, resulting in a denial-of-service.

AnalysisAI

Denial-of-service in an IEC 61850 MMS (Manufacturing Message Specification) protocol implementation allows an attacker with an established MMS session to crash the MMS handling process by sending a malformed BER-encoded confirmed-request message over TCP port 102. The flaw is a heap out-of-bounds read (CWE-125) in the BER decoder's boundary handling. No public exploit or active exploitation is identified at time of analysis; the CVSS 4.0 score of 7.1 reflects a high availability impact with low required privileges and no user interaction.

Technical ContextAI

MMS is the application-layer protocol defined by ISO 9506 and used within IEC 61850 for substation automation and other OT/ICS environments, typically carried over ISO-TSAP/COTP on TCP port 102. Protocol data units are serialized using ASN.1 Basic Encoding Rules (BER), a tag-length-value scheme where a decoder must trust and validate length fields to know how far to advance its read pointer. The root cause here is CWE-125 (Out-of-bounds Read): while parsing certain fields inside a confirmed-request PDU, the BER decoder advances its internal read position incorrectly on a crafted element, causing it to read past the bounds of the heap buffer. Because the process does not survive the invalid access, the result is a crash rather than a controlled information leak.

RemediationAI

No patched version is specified in the available data, so consult CISA advisory ICSA-26-211-10 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10) and its CSAF record for the vendor-released fix and apply the exact patched firmware/software version once identified - patching is the primary remediation. Until then, apply OT network segmentation and restrict TCP port 102 so that only trusted, explicitly authorized engineering and SCADA hosts can open MMS sessions (using firewall allow-lists or a data diode/one-way gateway where feasible); this directly removes the attacker's ability to reach the vulnerable decoder, with the trade-off that any legitimate MMS client not on the allow-list will also lose connectivity and must be enumerated first. Additionally, monitor for and rate-limit anomalous or malformed MMS traffic via an ICS-aware IDS, and ensure the MMS handling process auto-restarts and alerts on crash so a DoS attempt is transient and visible rather than a sustained outage.