Executive brief
A vulnerability exists in libiec61850, a software library used in the energy sector to facilitate communication between industrial control devices. An attacker on the same local network could send a specially crafted message during the connection process to crash the service. This would result in a denial-of-service, potentially disrupting power grid monitoring or control operations.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the ACSE (Association Control Service Element) layer of libiec61850. The flaw occurs during the parsing of AARQ (Associate Request) Protocol Data Units (PDUs) when establishing a Manufacturing Message Specification (MMS) connection. Specifically, when parsing fields within the 'calling AP title', the parser fails to properly validate attacker-controlled length values of zero or one. This causes the parser to read past the end of a heap buffer, resulting in a process crash and denial-of-service. The attack can be launched by an unauthenticated attacker on the adjacent network. The issue is resolved in version 1.6.2.
Affected products
- MZ Automation GmbH libiec61850 < 1.6.2
Timeline
- 2026-07-30: advisory: CISA ICSA-26-211-10 published
- 2026-07-30: disclosed: NVD publication date