Libiec61850 EUVD-2026-48428

A critical denial-of-service vulnerability in MZ Automation's libiec61850 library (CVE-2026-50039, CVSS 8.7) allows unauthenticated remote attackers to crash IEC 61850 MMS servers deployed in power-grid and industrial automation environments. With no public exploit identified at time of analysis, critical infrastructure operators nonetheless face immediate operational continuity risk from remote attacks requiring no authentication or system access. The absence of an available vendor patch makes interim network-level mitigations essential to maintain operational resilience.

Within 24 hours, identify all systems running libiec61850 in your environment and map network exposure; determine which instances are accessible from untrusted networks or the internet and notify incident response and operational technology teams of the remote unauthenticated denial-of-service risk. Within 7 days, implement firewall rules to restrict IEC 61850 MMS protocol access to only authorized control systems, deploy network monitoring to detect anomalous Read Requests or buffer overflow indicators, and test existing redundancy or failover mechanisms to ensure they minimize impact of potential service crashes. Within 30 days, contact MZ Automation for patch status and timeline, evaluate alternative IEC 61850 protocol implementations from other vendors as contingency options, and document your compensating controls in your operational technology risk register.

No vendor-released patch identified at time of analysis. Implement network segmentation restricting IEC 61850 MMS port access to authorized control centers only via firewall rules; deploy protocol-level monitoring or deep-packet inspection to detect anomalous Read Requests targeting the buffer overflow condition; establish or validate redundancy and automatic failover mechanisms to minimize service disruption from crashes; maintain detailed logging of all MMS protocol activity for anomaly detection and forensics; avoid connecting affected libiec61850 instances to untrusted networks or the internet; maintain escalated communication with MZ Automation regarding patch availability.