EUVD-2026-52017
GHSA-vj8r-wqrg-59qf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated vector with no complexity; impact is restricted to a service crash with no confidentiality or integrity exposure, warranting A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAccessHandler of the file src/iec61850/server/mms_mapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not on the heap. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to resolve this issue. The patch is identified as 5b2a69f44256b8548927d8afdd7ac5f5381abe1e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
AnalysisAI
Remote unauthenticated crash in mz-automation libiec61850 1.6.0-1.6.1 allows a network attacker to terminate an IEC 61850 MMS server by supplying an oversized Report ID string to the Report Control Block write handler, triggering a free of non-heap memory (CWE-590). No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a public proof-of-concept exploit exists at the referenced GitHub issue. Active exploitation has not been confirmed by CISA KEV, but the combination of a public PoC and trivial exploitation path elevates practical risk in operational technology environments where IEC 61850 server continuity is safety-critical.
Technical ContextAI
libiec61850 (CPE: cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:*) is an open-source C library implementing the IEC 61850 protocol suite - the international standard governing communication between intelligent electronic devices in electrical substations and power automation systems. The vulnerability is in src/iec61850/server/mms_mapping/reporting.c within the Reporting_RCBWriteAccessHandler function, which processes MMS (Manufacturing Message Specification) Write requests targeting Report Control Block (RCB) attributes such as RptID. CWE-590 (Free of Memory Not on the Heap) indicates that the code attempted to free a pointer that does not reference heap-allocated memory - characteristic of freeing a stack buffer or a pointer into a static or literal segment - triggering undefined behavior and typically an immediate process abort. The patch (commit 5b2a69f44256b8548927d8afdd7ac5f5381abe1e) adds an explicit length guard before processing: if MmsValue_getStringSize(value) exceeds 129 characters, the handler returns DATA_ACCESS_ERROR_OBJECT_VALUE_INVALID and exits early. A companion check was added in sendNextReportEntrySegment to reject oversized RptID strings during report transmission, closing a related code path.
RemediationAI
Vendor-released patch: libiec61850 v1.6.2, available at https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2 with the specific fix commit 5b2a69f44256b8548927d8afdd7ac5f5381abe1e at https://github.com/mz-automation/libiec61850/commit/5b2a69f44256b8548927d8afdd7ac5f5381abe1e. Upgrade to v1.6.2 is the definitive remediation. For deployments where an immediate library upgrade and recompilation is not feasible, restrict inbound MMS traffic (typically TCP port 102) to known, trusted MMS client IP addresses via firewall ACLs - this reduces the attack surface to compromised or malicious internal clients only, but does not eliminate risk. In substation or critical infrastructure contexts, enabling out-of-band process supervision (watchdog timers, systemd service restart policies) can reduce the operational impact of a crash while a patched build is prepared, though this is a resilience measure, not a security fix. Third-party product vendors embedding libiec61850 should release updated firmware or software builds incorporating v1.6.2.
More in Libiec61850
View allAn issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Same weakness CWE-590 – Free of Memory not on the Heap
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today