MZ Automation lib60870 Flaw Allows Unauthenticated Remote ICS DoS
The out-of-bounds read (CVE-2026-16002, CVSS 8.2) requires no authentication or user interaction; update to version 2.4.1 closes it.
TL;DR
CISA published ICS advisory ICSA-26-204-07 for CVE-2026-16002, an out-of-bounds read (CWE-125) in MZ Automation lib60870 versions 2.4.0 and earlier. The vulnerability carries a CVSS 8.2 score and allows unauthenticated remote attackers to crash the IEC 60870-5-104 parsing process, denying service. Affected sectors include chemical, energy, and water. The fix is a version bump to 2.4.1. No exploitation in the wild has been reported to CISA.
CISA's advisory is the latest in a recurring pattern for MZ Automation's protocol libraries. Both lib60870 and its sister library libIEC61850 have accumulated multiple CVEs over the past several years for parsing-related crashes ranging from NULL pointer dereferences to buffer overflows. CISA issued a prior advisory for libIEC61850 in 2022 covering buffer overflows with CVSS 10.0 scores (https://www.cisa.gov/news-events/ics-advisories/icsa-22-251-01). CVE-2026-16002 fits that mold.
The fix is straightforward. Update to lib60870 version 2.4.1. But the operational question is whether organizations know where the library sits in their stack. lib60870 is deployed worldwide in chemical, energy, and water systems for SCADA communications, and it's often embedded inside vendor-supplied control platforms where the asset owner doesn't directly manage the dependency. CISA reports no known exploitation in the wild, but the advisory's CVSS vector (AV:N/AC:L/PR:N/UI:N) means an exposed device is trivially reachable. Standard ICS network isolation practices mitigate exposure while teams track down instances of the library: keep control system devices off the internet and segment them from business networks.
Published ·Deep Fathom