libiec61850 EUVD-2026-51338

Exploitation requires only network TCP reachability to port 102 (ISO-on-TCP/MMS) of a device running libiec61850 prior to 1.6.2 - no authentication, no user interaction, and no non-default feature toggle, since the flaw is hit during standard ISO Presentation normal-mode negotiation that occurs before MMS session establishment. The specific trigger is a presentation data field supplied with a zero-length value during that negotiation. The primary limiting factor is exposure: IEC 61850/MMS devices are typically deployed on segmented OT networks rather than the public internet, so realistic risk depends on whether TCP/102 is reachable from an attacker-controlled position; impact is also limited to availability (process crash/DoS), with no code execution or confirmed data disclosure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) is internally consistent with the description: network-reachable, no authentication, no user interaction, low complexity, and a pure availability impact (denial of service only) with no confidentiality or integrity loss - the score of 8.7 is driven entirely by the ease of remotely crashing the process. Although the tags list 'Information Disclosure,' the description states the over-read causes process termination, not data leakage, so treat information disclosure as a theoretical property of an out-of-bounds read rather than a demonstrated outcome - VC:N in the vector supports the DoS-only reading. There is no EPSS score, no SSVC decision data, and no POC or KEV listing in the input, so exploitation is currently unconfirmed; however, the pre-session, unauthenticated trigger on a fixed well-known port (102) means the barrier to exploitation is low and the issue is realistically automatable against any internet- or network-exposed IEC 61850 endpoint. This is a genuine priority for OT operators running exposed substation/MMS servers, tempered by the fact that impact is limited to availability (a crash/reboot loop) rather than code execution or data theft.

An attacker with network reachability to an exposed IEC 61850 device opens a TCP connection to port 102 and sends a crafted ISO Presentation normal-mode negotiation PDU containing a presentation data field with a zero-length value. The missing length check triggers a heap over-read that terminates the MMS server process before authentication or session setup, dropping the device offline; repeating the connection can sustain a denial-of-service or crash-loop condition. No public exploit code is identified at time of analysis, but the low complexity and pre-auth trigger make weaponization straightforward.