Libiec61850

Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows a local attacker with low privileges to corrupt heap memory by supplying a crafted GetNamedVariableListAttributesResponse itemId argument to the MmsMapping_varAccessSpecToObjectReference function in the MMS Protocol Workflow. A public proof-of-concept exploit has been released and is available for download. The vulnerability has not yet been patched; the project was notified via GitHub issue #599 but has not responded at time of analysis. No active exploitation is confirmed by CISA KEV, though the publicly available PoC meaningfully elevates near-term risk.

Out-of-bounds read in mz-automation libiec61850 up to version 1.6.1 allows remote unauthenticated attackers to crash the IEC 61850 MMS server process and potentially leak heap or stack memory contents by sending a crafted MMS DataSet access request. The root cause is unconstrained string copy operations in the checkDataSetAccess function, now confirmed fixed in v1.6.2 via bounded copy with a 129-byte limit. A public exploit has been disclosed; however, this vulnerability is not listed in CISA KEV and the CVSS 4.0 score of 6.9 (Medium) reflects limited impact scope confined to availability of the vulnerable system.

Remote unauthenticated crash in mz-automation libiec61850 1.6.0-1.6.1 allows a network attacker to terminate an IEC 61850 MMS server by supplying an oversized Report ID string to the Report Control Block write handler, triggering a free of non-heap memory (CWE-590). No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a public proof-of-concept exploit exists at the referenced GitHub issue. Active exploitation has not been confirmed by CISA KEV, but the combination of a public PoC and trivial exploitation path elevates practical risk in operational technology environments where IEC 61850 server continuity is safety-critical.

Heap buffer over-read in MZ Automation GmbH's libiec61850 (versions prior to 1.6.2) allows an unauthenticated adjacent-network attacker to crash the MMS service process by sending a crafted BER-encoded message with an invalid length value in a BOOLEAN or INTEGER field. The MMS BER decoder performs no bounds validation on the attacker-supplied length, causing a read past the end of a heap-allocated buffer and subsequent process termination. CISA ICS-CERT issued advisory ICSA-26-211-10 for this vulnerability; no public exploit code or KEV listing has been identified at time of analysis.

Denial-of-service in MZ Automation's libiec61850 (versions before 1.6.2) allows an unauthenticated attacker on the process bus to crash IEC 61850 subscriber processes with a single crafted GOOSE frame. The GOOSE payload parser mishandles nested length fields, so an inner element length that exceeds its enclosing length forces a one-byte out-of-bounds read (CWE-125) that reliably terminates the subscriber. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CISA ICS advisory (ICSA-26-211-10) and a vendor patch are available.

Denial-of-service in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an adjacent unauthenticated attacker to crash the MMS server process by sending a crafted BER-encoded confirmed request PDU containing an extended BER tag over an established MMS session. The missing bounds check in the buffer decoder causes a one-byte heap out-of-bounds read, terminating the MMS service and disrupting IEC 61850-based industrial control communications. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Out-of-bounds heap read in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an unauthenticated adjacent-network attacker to crash an MMS server by sending a crafted AARQ PDU with a zero or one-byte length value in the calling AP title field during connection establishment. The ACSE parser fails to bounds-check the attacker-controlled length, reading past the end of a heap buffer and causing availability loss - a significant concern in IEC 61850 substation automation environments where device availability underpins grid protection and monitoring. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; a vendor patch (version 1.6.2) is available per CISA ICS advisory ICSA-26-211-10.

Remote unauthenticated denial of service in MZ Automation's libiec61850 (all versions before 1.6.2) allows an attacker to crash IEC 61850/MMS server processes by opening a crafted TCP/102 connection. The flaw sits in the ISO Presentation layer's normal-mode negotiation, where a missing length check on an attacker-controlled zero-length field triggers a bounded heap out-of-bounds read that terminates the process before any MMS session is even established. No public exploit identified at time of analysis and it is not on CISA KEV, but the pre-authentication network reach and low complexity make it a credible availability threat to exposed OT/ICS devices.

Denial of service in MZ Automation's libiec61850 library allows a network-adjacent attacker to crash an IEC 61850 MMS server by sending a specially crafted WriteRequest whose listOfData field is empty, triggering a NULL pointer dereference (CWE-476) in the Write Named Variable List handler. Any device or application embedding the affected library as an MMS server - commonly protection relays, RTUs, gateways, and SCADA front-ends in electric-power and industrial environments - is exposed. Reported through CISA ICS-CERT (advisory ICSA-26-204-06) with no public exploit identified at time of analysis and no CISA KEV listing.

Denial of service in MZ Automation's libiec61850 lets a network-adjacent attacker crash any application subscribing to GOOSE traffic by transmitting a single crafted L2 GOOSE or R-GOOSE frame carrying a malformed TLV. Because the fault lives in the shared parser used by both the Layer-2 and routable variants, both transport modes are affected, and successful exploitation produces a NULL pointer dereference that terminates the subscriber process. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with availability-only impact.

Remote code execution in MZ Automation's libiec61850 IEC 61850 library is possible via a crafted MMS Initiate request that triggers a heap-based buffer overflow (CWE-122); RCE was demonstrated on hosts with ASLR disabled, while ASLR-enabled deployments face memory corruption or denial of service. Any device or application embedding this library and exposing the MMS/TCP (typically port 102) service to attacker-reachable networks is affected. Reported through CISA ICS-CERT (ICSA-26-204-06); no public exploit identified at time of analysis and no EPSS/KEV signal is present in the source data.

Denial of service in MZ Automation's libiec61850 library allows remote unauthenticated attackers to corrupt memory by sending a crafted Read Request, triggering a stack-based buffer overflow (CWE-121). The flaw affects the IEC 61850 MMS server implementation used in power-grid and industrial automation devices, and was disclosed via a CISA ICS advisory (ICSA-26-204-06). No public exploit is identified at time of analysis, and the vendor CVSS 4.0 vector scores only availability impact, indicating a service crash rather than confirmed code execution.

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based buffer overflow via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based buffer overflow via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.

In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_file_service.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer_handleDeleteNamedVariableListRequest function of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameListRequest function to the. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) uses a NULL pointer in certain situations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) is vulnerable to a stack-based buffer overflow, which could allow an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) accesses a resource using an incompatible type, which could allow an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing the MMS_BIT_STRING data type. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive memory allocation and denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In libIEC61850 1.4.0, getNumberOfElements in mms/iso_mms/server/mms_access_result.c has an out-of-bounds read vulnerability, related to bufPos and elementLength. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In libIEC61850 1.4.0, BerDecoder_decodeUint32 in mms/asn1/ber_decode.c has an out-of-bounds read, related to intLen and bufPos. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In libIEC61850 1.4.0, MmsValue_newOctetString in mms/iso_mms/common/mms_value.c has an integer signedness error that can lead to an attempted excessive memory allocation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.