CISA warns of flaws in MZ Automation libIEC61850 used in industrial systems
CISA published an ICS advisory on MZ Automation libIEC61850, warning that multiple vulnerabilities in versions 1.0.0 through 1.6.1 could let a network-adjacent attacker crash industrial control services or execute code in some cases.
MZ Automation's libIEC61850 contains multiple vulnerabilities that could let a network-adjacent attacker crash IEC 61850 services or, in one case, execute arbitrary code, CISA said in an industrial control systems advisory published July 23.
CISA said IEC 61850 software is used in systems tied to critical manufacturing, energy and transportation, and that successful exploitation could disrupt protection, visibility and control functions in affected deployments.
The agency identified four issues in libIEC61850 versions 1.0.0 through 1.6.1. One is a stack-based buffer overflow tracked as CVE-2026-50039 that may cause memory corruption through a ReadRequest. CISA rated it 7.5 under CVSS v3.1 and 8.7 under CVSS v4.0.
Another issue, CVE-2026-49035, is a heap-based buffer overflow tied to a crafted MMS Initiate request. The advisory said remote code execution has been demonstrated when ASLR is disabled. With ASLR enabled, the issue may still lead to memory corruption or denial of service. CISA rated it 8.1 under CVSS v3.1 and 9.2 under CVSS v4.0.
CISA also listed CVE-2026-50103, a null pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may let a network-adjacent attacker crash a subscribing application with a crafted GOOSE frame that contains a malformed TLV value. The advisory gave it a 6.5 CVSS v3.1 score and a 7.1 CVSS v4.0 score.
The fourth issue, CVE-2026-50032, is a null pointer dereference in the MMS Write Named Variable List handler. CISA said a network-adjacent attacker could crash the server by sending a WriteRequest with an empty listOfData field. It carries a 7.5 CVSS v3.1 score and an 8.7 CVSS v4.0 score.
CISA said the product is deployed worldwide and listed Germany as the company headquarters location. The advisory named Abhinav Agarwal as the reporter of the vulnerabilities.
For remediation, MZ Automation recommends updating to the latest build of the libIEC61850 standard, with documentation available in the project’s GitHub repository, according to the advisory. CISA said it was not aware of any public exploitation specifically targeting these vulnerabilities at the time of publication.
CISA’s advisory also repeated general guidance for industrial operators, including minimizing network exposure for control system devices, placing control networks behind firewalls and using secure remote access methods such as VPNs when remote access is needed.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()