CISA 2026-07-23

MZ Automation libIEC61850

Machine-generated analysis · WAYSCloud LLM

libIEC61850 versions 1.0.0 through 1.6.1 are affected by stack- and heap-based buffer overflows. The advisory advises updating to the latest build.

Context

The affected product is MZ Automation’s libIEC61850 library, versions >=v1.0.0 and <=v1.6.1. The advisory states that an unauthenticated network-adjacent attacker could cause memory corruption, leading to crashes or arbitrary code execution. A heap-based overflow via a crafted MMS Initiate request can achieve remote code execution when ASLR is disabled.

Operator considerations

Check: Verify the installed libIEC61850 version is not within the vulnerable range.
Patch: Update to the latest libIEC61850 build from the vendor’s GitHub repository.
Log: Monitor for unexpected ReadRequest or MMS Initiate traffic and for process crashes.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.

The following versions of MZ Automation libIEC61850 are affected:

libIEC61850 >=v1.0.0|=v1.0.0|

Read the full advisory on CISA →