Multiple Denial-of-Service Vulnerabilities Found in MZ Automation GmbH libiec61850
CISA has issued an advisory detailing eight critical vulnerabilities in MZ Automation GmbH's libiec61850 library, potentially allowing unauthenticated attackers to cause denial-of-service conditions in industrial control systems.
CISA has alerted operators of industrial control systems to a series of critical vulnerabilities affecting MZ Automation GmbH's libiec61850 library. The advisory, published as ICSA-26-211-10, highlights eight distinct flaws, all of which could permit an unauthenticated attacker to induce a denial-of-service (DoS) condition on affected devices. These vulnerabilities are present in versions of the libiec61850 library prior to 1.6.2.
The affected library is crucial for communication in the energy sector and is deployed globally. The vulnerabilities primarily stem from improper validation of data fields within network frames and messages, leading to out-of-bounds read errors. When exploited, these errors can cause the affected processes to crash, rendering the system unavailable.
Several specific vulnerabilities have been detailed. CVE-2026-66720 and CVE-2026-66364 target the GOOSE subscriber and payload parser components, respectively. They involve improper validation of timestamp fields or payload lengths in IEC 61850 GOOSE Layer-2 multicast messages. A specially crafted frame with an undersized or oversized timestamp/length can trigger a heap out-of-bounds read, leading to a DoS.
Further vulnerabilities, CVE-2026-66369 and CVE-2026-66364, also affect the GOOSE parser. These flaws exploit boundary-handling issues where the parser advances its internal buffer position incorrectly, resulting in a heap out-of-bounds read and process termination. These are triggered by unauthenticated Layer-2 multicast frames on the process bus.
The Message Specification (MMS) BER decoder is also implicated in several flaws. CVE-2026-63550 and CVE-2026-65421 involve boundary-handling issues within the MMS BER decoder when processing confirmed-request messages or fixed-width BER fields. An attacker can send crafted BER-encoded elements that cause the decoder to read past the end of a heap buffer, leading to a DoS.
Additionally, CVE-2026-66349 affects the MMS server connection handler. A missing bounds check when processing an MMS confirmed request PDU with an extended BER tag can lead to a one-byte heap out-of-bounds read, terminating the MMS service process. The common thread across these vulnerabilities is the failure to properly validate lengths or bounds of incoming data, leading to memory corruption and service disruption.
MZ Automation GmbH has released version 1.6.2 of the libiec61850 library, which addresses all identified vulnerabilities. Users are strongly advised to update to this latest version to mitigate the risks. The vulnerabilities have been assigned CVSS v3.1 base scores of 6.5 (Medium) and CVSS v4.0 base scores of 7.1 (High), reflecting their potential impact on system availability.