lib60870-C CVE-2026-67873

Exploitation requires the target to be running lib60870-C 2.4.0 acting as a server with the IEC 60870-5 file transfer feature in use, since the flaw is in the server-side FileSegment ASDU encoding path (FileSegment_encode()) and is only reached when the server encodes a file segment into an ASDU frame whose residual capacity is exceeded. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required at the protocol layer, so a network-reachable, unauthenticated peer that can initiate or influence a file-transfer operation is sufficient. Limiting factors: the file-transfer functionality must be enabled/used (not merely basic monitoring/control), the server must be network-exposed or reachable by the attacker's station, and deployments that enforce IEC 62351-3 TLS plus secure-authentication substantially raise the bar by requiring an authenticated trusted peer.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) treats this as remotely and trivially exploitable with full CIA impact, consistent with a memory-corruption bug that can lead to code execution on a network-facing ICS server. However, key exploitation-probability signals are absent: no EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no public proof-of-concept is referenced - only an upstream issue (#201). The CVSS network/unauthenticated rating should be weighed against the nature of the defect: it is in the server-side FileSegment ENCODING path, so exploitation realistically requires the file-transfer feature to be in use and the server to be induced (e.g., by a connected/malicious peer requesting a file) into encoding a segment that overflows the frame - a meaningful precondition the base score does not surface. Net assessment: genuinely high-severity for exposed IEC 60870-5 servers that enable file transfer, but treat active-exploitation urgency as unconfirmed; the 9.8 reflects worst-case impact and reachability, not evidence of widespread exploitation. Missing EPSS/KEV/POC data means prioritization should lean on exposure and configuration rather than on demonstrated in-the-wild activity.

An attacker with network access to an exposed IEC 60870-5-104 server (or a peer station able to initiate file transfer) requests or triggers a file-send operation whose segment sizing causes FileSegment_encode() to write past the end of the ASDU frame heap buffer. The resulting heap corruption crashes the telecontrol server (denial of service in an operational SCADA context) and may be shaped into remote code execution. No public proof-of-concept is currently referenced, so exploitation would require independent development against the specific build.