Executive Summary
Eight out-of-bounds read vulnerabilities in MZ Automation GmbH libiec61850 versions below 1.6.2 allow a network-adjacent attacker to trigger a denial-of-service condition by sending malformed IEC 61850 protocol data units to the parser. Because libiec61850 is the reference implementation embedded across substation IEDs, gateways, and protection relays, a single crafted MMS or GOOSE frame can drop the communication process that carries protection and control telemetry between the station bus and the operator.
Technical Exposure Breakdown
The vulnerable component is the libiec61850 library, an open source and widely licensed stack that terminates MMS over TCP 102 and parses GOOSE and Sampled Values traffic on the station and process bus. The eight CVEs (CVE-2026-66720, CVE-2026-66369, CVE-2026-63550, CVE-2026-65421, CVE-2026-66364, CVE-2026-66349, CVE-2026-56758, CVE-2026-66360) share a common class: out-of-bounds read during decode of attacker-controlled length or offset fields. The highest scored issue carries a CVSS v3 base of 7.5, consistent with a network attack vector, low complexity, no privileges, and an availability-only impact.
The attack vector is remote and unauthenticated in the typical deployment. IEC 61850 MMS associations frequently run without transport authentication, and GOOSE and Sampled Values are Layer 2 multicast with no built-in integrity checking. An attacker positioned on the station LAN, or reaching TCP 102 through a poorly segmented engineering path, can deliver a single malformed ASN.1 or manufacturing message specification structure. The parser reads past the allocated buffer, faults, and the hosting process terminates or hangs. No memory corruption for code execution is indicated in the advisory, but availability loss on a protection device is not a lesser outcome in this domain.
The conditions for exploitation are undemanding. The library is embedded in third-party products, so many asset owners will not know libiec61850 is present until they map firmware bills of materials. Version identification is complicated because vendors statically link the library and rarely expose the version string over the wire.
OT Impact and Compliance Risk
A crash in the IEC 61850 stack does not necessarily open a breaker, but it severs the visibility and control path the operator depends on. Loss of GOOSE messaging between protection relays can defeat interlocking and blocking schemes that rely on peer signaling, and a downed MMS server blinds SCADA to the substation state. In a fault condition occurring during the outage window, that gap has direct physical consequences.
For NERC CIP registered entities, an availability event on a BES Cyber System touches CIP-007 for patch and vulnerability management and CIP-008 if the disruption meets reportable event thresholds. Under IEC 62443, this is a failure of the zone and conduit model if unauthenticated MMS reaches the device from outside the trusted zone, and it maps directly to component requirements for input validation robustness. Operators should treat this as a resilience finding, not merely a patching backlog item.
Compensating Controls
Do not rely on active scanning to inventory affected devices. Probing IEC 61850 endpoints with generic tooling can itself trigger the same malformed-input crash the advisory describes, so treat scanning of energized protection equipment as a change with outage risk. Use passive traffic analysis and firmware SBOM review to locate libiec61850 instances.
- Enforce conduit filtering so TCP 102 is reachable only from named engineering and gateway hosts inside the station zone. Deny all other sources at the firewall or managed switch ACL.
- Constrain GOOSE and Sampled Values multicast to the process bus VLAN and block those Ethertypes from crossing into general network segments.
- Deploy a virtual patch at the network boundary. A Suricata concept: alert and drop on MMS PDUs where declared ASN.1 length fields exceed the remaining segment payload, and flag confirmed-request structures with out-of-range offset values. This shifts input validation to a device that can fail without dropping protection.
- Rate-limit and log new associations to TCP 102 so a repeated crash-and-reconnect pattern is caught before it becomes a sustained outage.
- Coordinate the move to libiec61850 1.6.2 or later through vendor firmware channels during a planned maintenance window, since the library is embedded rather than field-updatable on most devices.
Sequence upgrades by protection criticality and validate each device under load before returning it to service.
BreachSpider Intel
BreachSpider tracks embedded-library exposure like libiec61850 across the OT vendor supply chain so operators can identify affected devices without touching energized equipment. Monitor your fleet at BreachSpider.