Skip to main content

libiec61850 CVE-2026-66360

| EUVDEUVD-2026-51338 HIGH
Out-of-bounds Read (CWE-125)
2026-07-30 icscert GHSA-xhv7-j6rr-ph72
Buffer Overflow Denial Of Service Information Disclosure Libiec61850
8.7
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Pre-auth, low-complexity crash reachable over the network on TCP/102 with no user interaction; impact is availability-only (process termination), so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 23:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 23:22 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 23:22 NVD
7.5 (HIGH) 8.7 (HIGH)
Analysis Generated
Jul 30, 2026 - 23:20 vuln.today
Patch available
Jul 30, 2026 - 23:04 EUVD
CVE Published
Jul 30, 2026 - 22:25 cve.org
HIGH 7.5

DescriptionCVE.org

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This condition occurs before MMS session establishment, a crafted TCP/102 connection attempt can trigger the issue. The resulting over read causes the process to terminate, leading to a denial of service condition.

AnalysisAI

Remote unauthenticated denial of service in MZ Automation's libiec61850 (all versions before 1.6.2) allows an attacker to crash IEC 61850/MMS server processes by opening a crafted TCP/102 connection. The flaw sits in the ISO Presentation layer's normal-mode negotiation, where a missing length check on an attacker-controlled zero-length field triggers a bounded heap out-of-bounds read that terminates the process before any MMS session is even established. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach device on TCP/102
Delivery
Send crafted ISO Presentation negotiation PDU
Exploit
Zero-length field bypasses missing length check
Execution
Trigger bounded heap over-read
Impact
MMS server process terminates (DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only network TCP reachability to port 102 (ISO-on-TCP/MMS) of a device running libiec61850 prior to 1.6.2 - no authentication, no user interaction, and no non-default feature toggle, since the flaw is hit during standard ISO Presentation normal-mode negotiation that occurs before MMS session establishment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) is internally consistent with the description: network-reachable, no authentication, no user interaction, low complexity, and a pure availability impact (denial of service only) with no confidentiality or integrity loss - the score of 8.7 is driven entirely by the ease of remotely crashing the process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network reachability to an exposed IEC 61850 device opens a TCP connection to port 102 and sends a crafted ISO Presentation normal-mode negotiation PDU containing a presentation data field with a zero-length value. The missing length check triggers a heap over-read that terminates the MMS server process before authentication or session setup, dropping the device offline; repeating the connection can sustain a denial-of-service or crash-loop condition. …
Remediation Vendor-released patch: upgrade libiec61850 to version 1.6.2 or later, which adds the missing length check in the ISO Presentation normal-mode negotiation path; downstream device vendors that embed the library must rebuild and redistribute firmware/applications against the fixed version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify and inventory all systems running MZ Automation libiec61850 versions prior to 1.6.2, with priority on Internet-facing or network-accessible IEC 61850/MMS servers. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libiec61850

View all
CVE-2018-19185 CRITICAL POC
9.8 Nov 12

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2018-18957 CRITICAL POC
9.8 Nov 05

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2018-18834 CRITICAL POC
9.8 Oct 30

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2020-7054 HIGH POC
8.8 Jan 14

MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
CVE-2019-19931 HIGH POC
8.8 Dec 23

In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
CVE-2024-28286 HIGH POC
7.5 Mar 21

In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
CVE-2024-26529 HIGH POC
7.5 Mar 13

An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
CVE-2023-27772 HIGH POC
7.5 Apr 13

libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
CVE-2022-21159 HIGH POC
7.5 Apr 15

A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
CVE-2019-16510 HIGH POC
7.5 Sep 19

libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
CVE-2019-1010300 HIGH POC
7.5 Jul 15

mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
CVE-2019-6719 HIGH POC
7.5 Jan 23

An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Share

CVE-2026-66360 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy