MZ Automation libIEC61850 Hit by Four Critical ICS Flaws
A heap-based buffer overflow in the MMS stack can achieve RCE when ASLR is off, a configuration that's common in embedded substation gear.
TL;DR
CISA issued an advisory covering four vulnerabilities in MZ Automation libIEC61850 versions 1.0.0 through 1.6.1. The library is deployed worldwide across critical manufacturing, energy, and transportation systems. The most severe (CVE-2026-49035, a heap-based buffer overflow in MMS Initiate request handling) carries a CVSS 4.0 score of 9.2 and has demonstrated remote code execution when ASLR is disabled. Two additional flaws allow denial-of-service via crafted GOOSE frames or malformed WriteRequests, and a stack-based buffer overflow in ReadRequest handling rounds out the set. MZ Automation recommends updating to the latest build but hasn't published a patch timeline or backward-compatibility guidance. All four were reported by a single researcher, Abhinav Agarwal.
What's in the advisory CISA published ICSA-26-204-06 on July 23 covering four vulnerabilities in MZ Automation's libIEC61850, the open-source IEC 61850 implementation library. The affected version range spans 1.0.0 through 1.6.1. CISA identifies critical manufacturing, energy, and transportation systems as the affected sectors, with deployments worldwide. The researcher credited is Abhinav Agarwal, who reported all four flaws to CISA. CVE-2026-50039 is a stack-based buffer overflow triggered via a crafted ReadRequest. The CVSS 3.1 vector shows network-exploitable, low-complexity, no privileges required, with a base score of 7.5 confined to availability impact (CVSS 4.0 score: 8.7). CVE-2026-49035 is the worst of the set, a heap-based buffer overflow reachable through a crafted MMS Initiate request. Remote code execution has been demonstrated when ASLR is disabled, earning a CVSS 3.1 score of 8.1 and a CVSS 4.0 score of 9.2. The 4.0 score reflects the full confidentiality, integrity, and availability impact under those conditions. CVE-2026-50103 sits in the shared GOOSE and R-GOOSE parser. A crafted GOOSE frame with a malformed TLV value triggers the crash of any subscribing application. It's classified under CWE-228 (Improper Handling of Syntactically Invalid Structure) with a CVSS 4.0 score of 7.1. CVE-2026-50032 is a NULL pointer dereference in the MMS Write Named Variable List handler triggered by a WriteRequest containing an empty listOfData field. Network-adjacent, no authentication, CVSS 4.0 score 8.7, availability impact only. The advisory carries no mention of active exploitation and lists the vendor's recommendation as updating to the latest build from the project's GitHub repository. No specific patch version, release date, or backport guidance appears in the advisory. For organizations running libIEC61850 inside substation equipment, the ASLR-dependent RCE vector on CVE-2026-49035 is the one that dictates response priority. The two NULL-pointer and malformed-input crashes share the same attack surface (network-adjacent, no credentials) and any device exposing MMS or GOOSE on an insufficiently segmented network is reachable.
Published ·Deep Fathom