EUVD-2026-53677
GHSA-vgf8-x653-r7r2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated per protocol, but reached only via the server file-transfer encoding path under specific segment sizing, so AC:H; heap corruption yields potential code execution, hence C/I/A High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding object fields and segment data
AnalysisAI
Heap-based buffer overflow in lib60870-C 2.4.0 affects the server-side FileSegment ASDU encoding path, where FileSegment_encode() checks only the standalone segment length via FileSegment_GetMaxDataSize() but never verifies remaining capacity in the current ASDU frame before writing object fields and segment data. In IEC 60870-5-101/104 telecontrol servers using the library's file transfer functionality, this out-of-bounds heap write can corrupt memory, enabling denial of service and potentially remote code execution. There is no public exploit identified at time of analysis, and the flaw is tracked upstream as issue #201 against the current 2.4.0 release.
Technical ContextAI
lib60870-C is MZ Automation's open-source C implementation of the IEC 60870-5-101 (serial) and IEC 60870-5-104 (TCP/IP) telecontrol protocols, widely used inside RTUs, gateways, and SCADA front-end servers in electric power and other critical-infrastructure automation. The bug lives in the file-transfer subsystem: an ASDU (Application Service Data Unit) frame carries File Segment information objects, and FileSegment_encode() must serialize an object address, segment length byte, and the raw segment payload into a fixed-size frame buffer. Per CWE-122 (heap-based buffer overflow), the root cause is a missing bounds check - the code validates the logical maximum segment size returned by FileSegment_GetMaxDataSize() but does not confirm that the residual free space in the already-partially-filled ASDU frame is large enough for the encoded fields plus data, so the write runs past the heap allocation. This is an encoding-side (outbound serialization) defect rather than a parser/decoder flaw, so it is reached through the server's own file-send path.
RemediationAI
No vendor-released patch identified at time of analysis - version 2.4.0 is the current tagged release and is the affected version, and its release notes (secure-authentication integration, improved interrogation handling, IEC 62351-3 compliance) do not reference a fix for issue #201, so a fixed release version cannot be independently confirmed; monitor https://github.com/mz-automation/lib60870/issues/201 and the releases page for an upstream fix and rebuild once available. As compensating controls, disable or do not enable the IEC 60870-5 file transfer functionality on servers that do not require it, since the overflow is reached through the FileSegment encoding path (trade-off: loses file-transfer capability for firmware/config exchange). Restrict network reachability of the 104/TCP telecontrol endpoint to a strict allowlist of known peer stations via firewall rules and place the server on an isolated ICS/OT segment (trade-off: peers must be inventoried and static). Where supported, enable IEC 62351-3 TLS and the library's secure-authentication so only authenticated, mutually-trusted stations can drive the server into file-transfer operations (trade-off: certificate/key management overhead and interoperability testing). Consult the project user guide at https://github.com/mz-automation/lib60870/blob/master/user_guide.adoc for configuration specifics.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today