Executive brief
A security flaw exists in libiec61850, an open-source library used in industrial automation and power grid systems to facilitate communication between electrical devices. An attacker with access to the local network could potentially bypass security checks by replaying captured data packets. This could allow unauthorized commands to be sent to critical infrastructure equipment, potentially disrupting operations or causing equipment malfunction.
Technical details
An authentication bypass vulnerability exists in the parseGoosePayload() function within /goose/goose_receiver.c of libiec61850 v1.6. The flaw relates to how the library handles Generic Object Oriented Substation Event (GOOSE) frames, specifically failing to properly validate or prevent the replay of captured frames. An attacker on the same local network (Layer 2) can capture legitimate GOOSE traffic and replay it to bypass authentication mechanisms. This could lead to unauthorized control of Intelligent Electronic Devices (IEDs) in industrial environments. While the advisory is marked as 'info' by some sources, the nature of authentication bypass in industrial protocols typically warrants a higher severity assessment.
Affected products
- MZ Automation libiec61850 1.6
Timeline
- 2026-07-31: disclosed: CVE-2026-52134 published