Executive Summary and Immediate Action Required
On July 23, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued Industrial Control Systems (ICS) Advisory ICSA-26-204-06, warning of multiple vulnerabilities in MZ Automation libIEC61850 software library. The affected software library is widely implemented across critical infrastructure sectors including Energy, Critical Manufacturing, and Transportation Systems worldwide. These vulnerabilities impact all deployments using MZ Automation libIEC61850 versions from v1.0.0 up to and including v1.6.1.
Successful exploitation of these security flaws allows an unauthenticated, network-adjacent attacker to crash critical IEC 61850 server and client services or execute arbitrary code on affected devices. Such disruptions directly compromise the availability, visibility, and operational control of substations, industrial automation systems, and remote terminal units. Organizations utilizing libIEC61850 must immediately audit their environments, recompile integrated applications with patched library builds, and enforce strict network segmentation across operational technology (OT) networks.
Vulnerability Overview and Technical Analysis
The advisory highlights four distinct vulnerabilities within libIEC61850, spanning stack and heap buffer overflows as well as improper input handling in Manufacturing Message Specification (MMS) and Generic Object Oriented Substation Events (GOOSE) parsing logic.
| CVE ID | CWE ID | CVSS v3.1 | CVSS v4.0 | Vulnerability Type | Impacted Component |
|---|---|---|---|---|---|
| CVE-2026-49035 | CWE-122 | 8.1 (HIGH) | 9.2 (CRITICAL) | Heap-based Buffer Overflow | MMS Initiate Request Handler |
| CVE-2026-50039 | CWE-121 | 7.5 (HIGH) | 8.7 (HIGH) | Stack-based Buffer Overflow | ReadRequest Message Parser |
| CVE-2026-50032 | CWE-476 | 7.5 (HIGH) | 8.7 (HIGH) | NULL Pointer Dereference | MMS Write Named Variable List Handler |
| CVE-2026-50103 | CWE-228 | 6.5 (MEDIUM) | 7.1 (HIGH) | NULL Pointer Dereference | L2 GOOSE / R-GOOSE Shared Parser |
CVE-2026-49035: Heap-based Buffer Overflow in MMS Initiate Request
CVE-2026-49035 represents the highest severity vulnerability in the advisory, assigned a CVSS v4.0 base score of 9.2 (Critical). The flaw resides in the handling of MMS Initiate requests. An unauthenticated attacker capable of sending network traffic to an IEC 61850 service can craft a malicious MMS Initiate request that overflows heap memory allocations. Remote code execution (RCE) has been demonstrated in environments where Address Space Layout Randomization (ASLR) is disabled. In systems where ASLR is enabled, exploitation results in heap corruption leading to an immediate process crash and denial-of-service (DoS) condition.
CVE-2026-50039: Stack-based Buffer Overflow via ReadRequest Parsing
CVE-2026-50039 is a stack-based buffer overflow (CWE-121) caused by inadequate bounds checking when processing incoming ReadRequest structures. An unauthenticated attacker can send a specially crafted ReadRequest to cause stack corruption. This leads to application instability, daemon crashes, and potential arbitrary code execution within the security context of the libIEC61850 application process.
CVE-2026-50032: NULL Pointer Dereference in MMS Write Named Variable List
CVE-2026-50032 involves a NULL pointer dereference (CWE-476) inside the MMS Write Named Variable List handler. When a client sends a WriteRequest containing an empty listOfData field, the server fails to validate the presence of payload structures before attempting access. This unhandled condition triggers an immediate NULL pointer dereference, causing the IEC 61850 server process to terminate unexpectedly.
CVE-2026-50103: NULL Pointer Dereference in GOOSE and R-GOOSE Shared Parser
CVE-2026-50103 affects the Layer 2 GOOSE and Routable GOOSE (R-GOOSE) shared packet parser due to improper handling of syntactically invalid structures (CWE-228). A network-adjacent attacker can transmit a crafted GOOSE frame containing a malformed Type-Length-Value (TLV) payload. Subscribing applications parsing the frame encounter an unhandled NULL pointer dereference, causing local subscriber services to crash and disrupting time-critical field messaging.
Attack Path and Exploitation Dynamics
Attackers targeting OT infrastructure running vulnerable libIEC61850 instances rely on network access to field communication protocols. The typical attack progression unfolds as follows:
- Network Position Acquisition: The threat actor establishes network adjacency or gains access to the control system network segment where IEC 61850 endpoints, such as Intelligent Electronic Devices (IEDs), Programmable Logic Controllers (PLCs), or gateway devices, reside.
- Protocol Identification and Target Reconnaissance: The attacker scans the local network segment to identify open IEC 61850 MMS services listening on TCP port 102 or identifies active Layer 2 GOOSE multicast streams on the local Ethernet segment.
- Malformed Frame Transmission: Depending on the target service and objective, the attacker constructs a malformed protocol request, such as an MMS Initiate request with an oversized payload, a WriteRequest with an empty listOfData parameter, or a GOOSE frame with corrupted TLV values.
- Impact Execution: Delivery of the crafted frame causes memory corruption or NULL dereferences, crashing the target process or executing arbitrary code, thereby stripping operators of real-time monitoring and automation capability.
Warning: Prior to applying software patches or modifying network parameters on active control systems, engineering teams must conduct thorough risk assessments and impact analyses to prevent accidental disruption of critical physical processes.
Mitigation and Operational Hardening
Defending against these libIEC61850 vulnerabilities requires a combination of software updates, network architecture isolation, and operational controls.
Software Patching and Recompilation
Because libIEC61850 is a software library embedded into vendor firmware and custom OT applications, asset owners and system integrators must obtain updated builds from upstream repositories or device vendors. MZ Automation recommends updating to the latest build available from official project repository at https://github.com/mz-automation/libiec61850. System developers must recompile and test all dependent binaries before deploying updated firmware to production assets.
Network Exposure Reduction
Organizations must immediately audit OT network perimeters to prevent unauthorized protocol access:
- Ensure no control system devices, MMS servers, or IEC 61850 interfaces are directly exposed to the public internet.
- Place control system networks and remote terminal endpoints behind network firewalls, isolating them from corporate IT enterprise networks.
- Restrict Layer 2 Ethernet broadcast domains for GOOSE traffic using virtual local area networks (VLANs) to prevent cross-segment frame injection.
- Enforce strict ingress and egress filtering on TCP port 102 (MMS protocol traffic).
- Require encrypted Virtual Private Networks (VPNs) with robust multi-factor authentication for all remote administrative access, ensuring VPN endpoints are regularly patched.
Verification Checklist
- Identify all embedded systems, software applications, and vendor firmware relying on libIEC61850 versions v1.0.0 through v1.6.1.
- Obtain and compile the latest libIEC61850 source release from the vendor GitHub repository.
- Verify that Address Space Layout Randomization (ASLR) and stack canary protections are enabled during binary compilation for host systems.
- Confirm that TCP port 102 (MMS) is blocked at firewalls separating corporate IT and OT control zones.
- Audit network switches to confirm Layer 2 GOOSE traffic is restricted strictly to designated VLANs.
- Validate remote access routes to ensure direct internet access to field control assets is completely eliminated.
Source
Official CISA ICS Advisory ICSA-26-204-06: https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06