Executive brief
MZ Automation lib60870 is a software library used in industrial control systems to communicate using the IEC 60870-5-104 protocol, commonly found in energy and water utility sectors. A vulnerability in how the library handles specific network messages could allow an attacker to crash the device or potentially read small amounts of sensitive memory. This could lead to service disruptions in critical infrastructure operations.
Technical details
An out-of-bounds read (CWE-125) exists in the InformationObject_ParseObjectAddress function within cs101_information_objects.c. The vulnerability is caused by a lack of bounds checking on the msgSize parameter when processing the Variable Structure Qualifier (VSQ) field in an IEC 60870-5-104 I-frame. If the declared object count exceeds the actual ASDU body size, the function reads one byte past the end of the heap-allocated message buffer. This can be exploited remotely over TCP port 2404 without authentication. The issue was identified via fuzzing and is addressed in version 2.4.1.
Affected products
- MZ Automation lib60870 2.4.0
Timeline
- 2026-06-05: advisory: Vendor advisory GHSA-7v97-jmwv-w5j7 published
- 2026-07-30: disclosed: CISA Advisory ICSA-26-211-11 published
- 2026-07-30: patched: Version 2.4.1 released to address the issue