Two more lib60870 out-of-bounds reads hit CISA advisory
Third MZ Automation ICS advisory in a week, energy and water operators running 2.4.0 need a patch that isn't out yet.
TL;DR
CISA disclosed two out-of-bounds read vulnerabilities in MZ Automation's lib60870 2.4.0, the IEC 60870-5-104 library used in energy, water, and manufacturing SCADA systems. Both CVE-2026-61893 and CVE-2026-63033 let an unauthenticated attacker crash the device with a crafted I-frame, no code execution, but reliable denial of service. The fix is version 2.4.1, which isn't available yet. This is the third MZ Automation advisory CISA has published in seven days, following last week's warnings for lib60870 and libIEC61850.
The two new CVEs follow the same pattern as last week's lib60870 advisory: crafted IEC 60870-5-104 I-frames that trip heap-based out-of-bounds reads in message parsing. CVE-2026-61893 triggers in TestCommand_getFromBuffer via an inflated object count on a TypeID 104 message. CVE-2026-63033 hits InformationObject_ParseObjectAddress when the declared object count exceeds what the ASDU body actually contains. Both read one byte past the buffer. Both are unauthenticated, automatable, and network-reachable, CVSS 6.5 under v3.1, 6.9 under v4.0.
The stack of recent advisories is starting to look like a systematic cleanup rather than isolated findings. Last week brought one lib60870 advisory and four critical flaws in libIEC61850. Days later, eight more libIEC61850 heap out-of-bounds reads landed in a single advisory. Now two more for lib60870. Central Power Research Institute, Bengaluru, reported the current pair.
What the practitioner does now
The advisory says upgrade to 2.4.1 "when available." That's the problem, no release date, no commit hash, no interim mitigation beyond the standard ICS network-isolation boilerplate. For an energy or water utility running lib60870 2.4.0 in production SCADA, the options Monday morning are the same as last Monday: segment the network, monitor for anomalous IEC 60870-5-104 traffic, and wait.
These aren't remote-code-execution bugs. The impact is denial of service, a crashed device stops responding to SCADA commands, which matters if it's controlling a pump or a breaker. The CVSS vector captures it: low confidentiality impact (one byte leaked), no integrity impact, low availability impact because the crash is device-scoped. But in an operational context where that device is the only path to a physical process, "low availability impact" can be misleading.
Published ·Deep Fathom