Executive brief
A security vulnerability has been identified in lib60870, a software library used in industrial control systems to implement the IEC 60870-5-101/104 communication protocols. An attacker can send a specially crafted network message to a server using this library, causing the system to crash. This results in a denial-of-service condition, potentially disrupting the monitoring and control of critical infrastructure equipment.
Technical details
A heap buffer overflow exists in the CS104 server-side implementation of lib60870. The vulnerability is caused by a format mismatch in the high-priority ASDU queue: while HighPriorityASDUQueue_enqueue stores entries as a 16-bit size followed by raw bytes, HighPriorityASDUQueue_hasUnconfirmedIMessages traverses the queue as if entries begin with a metadata structure (sMessageQueueEntryInfo). This inconsistency leads to the misinterpretation of payload bytes as metadata, causing the traversal logic to read past the allocated buffer. An unauthenticated remote attacker can exploit this by sending crafted IEC 60870-5-104 messages to trigger a crash (Denial of Service). The issue was identified in version 2.3.6 and affects versions back to 2.3.3.
Affected products
- MZ Automation lib60870 2.3.3 to 2.3.6
Timeline
- 2026-06-29: disclosed: Vulnerability disclosed via NVD and GitHub issue.
- 2026-06-29: advisory