MZ Automation libIEC61850

product · product:mz-automation-libiec61850 single-source-national-cert

Coverage

first 2026-07-24 → last 2026-07-24

Latest activity

2026-07-24

A pre-auth RCE in the widely-embedded libIEC61850 substation library, energy and water OEMs, not a single…

Peak priority

notable

1 notable

Targets

energy

sectors: energy, water, manufacturing · regions: europe

Sources cited

1 hosts

Defender insights

What each entry about MZ Automation libIEC61850 tells a defender to do, newest first.

2026-07-24NOTABLEA pre-auth RCE in the widely-embedded libIEC61850 substation library, energy and water OEMs, not a single product, are affected

Defender takeaway

The risk here is embedded-supply-chain, not a single product to patch: libIEC61850 and lib60870 are linked into protection relays, RTUs, gateways and substation controllers from many vendors, so a package-manager version check will miss them. Swiss and European electricity-transmission, distribution and water operators should ask their substation-automation and telecontrol OEMs which firmware embeds these libraries and at what version, and prioritise the pre-auth RCE (CVE-2026-49035) on any device whose IEC 61850 MMS interface (TCP 102) is reachable beyond a tightly segmented process network. Because no fixed version is stated in the advisory text as retrieved, confirm remediation status directly with MZ Automation and via the advisory's CSAF JSON before assuming a fix exists. Standard OT segmentation applies with elevated weight given the unauthenticated, network-reachable profile: keep MMS/IEC 60870 endpoints off any business or internet-reachable path, and prefer up-to-date VPN-fronted access over direct exposure for any required remote engineering.

Story timeline

2026-07-24MZ Automation libIEC61850: unauthenticated heap-overflow RCE via crafted MMS Initiate (CVE-2026-49035) plus four sibling OT-library flaws
trending-vulnerabilitiesA pre-auth RCE in the widely-embedded libIEC61850 substation library, energy and water OEMs, not a single product, are affected

Hunting pivots

CVEs

CVE-2026-16002 CVE-2026-49035 CVE-2026-50032 CVE-2026-50039 CVE-2026-50103

Releases covered

MZ Automation libIEC61850

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-24/mz-automation-libiec61850-lib60870-ot-preauth-rce · ATT&CK page ↗

Entries about MZ Automation libIEC61850 (1)

2026-07-24 · view entry permalink →

NOTABLECVE-2026-49035 +4NATOA2

MZ Automation libIEC61850: unauthenticated heap-overflow RCE via crafted MMS Initiate (CVE-2026-49035) plus four sibling OT-library flaws

CISA advisory ICSA-26-204-06 (2026-07-23) discloses four vulnerabilities in MZ Automation's open-source libIEC61850 (versions 1.0.0 through 1.6.1), a C library implementing the IEC 61850 MMS/GOOSE substation-automation protocols and embedded as an OEM component in energy-sector protection, control and monitoring equipment worldwide (CISA, 2026-07-23). The most severe, CVE-2026-49035 (CWE-122 heap-based buffer overflow, CVSS 3.1 8.1 / CVSS 4.0 9.2), is triggered by a crafted MMS Initiate request with no authentication and no user interaction; CISA states remote code execution has been demonstrated where ASLR is disabled, degrading to memory corruption or denial of service where it is enabled (CISA, 2026-07-23). The three companion flaws are a stack overflow via a crafted ReadRequest (CVE-2026-50039), and two null-pointer-dereference DoS conditions, one in the shared L2 GOOSE/R-GOOSE parser via a malformed TLV (CVE-2026-50103), one in the MMS Write Named Variable List handler via a WriteRequest with an empty listOfData field (CVE-2026-50032). A companion advisory, ICSA-26-204-07, covers the sibling lib60870 library (versions ≤ 2.4.0, implementing IEC 60870-5-104 SCADA telecontrol used in chemical, energy and water/wastewater sectors) with an out-of-bounds-read parser-crash DoS, CVE-2026-16002 (CISA, 2026-07-23). CISA reports no known public exploitation of any of the five.

Defender takeaway

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

CISA (ICSA-26-204-06) 2026-07-23

vulnerability24 Jul 04:36Zsingle-source · national CERTOpen finding →

Sources: CISA (ICSA-26-204-06) · CISA (ICSA-26-204-07)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

MZ Automation lib60870×1
productproduct:mz-automation-lib60870
MZ Automation lib60870 out-of-bounds read parser-crash DoS (IEC 60870-5-104); lib60870 <= 2.4.0 (CVSS 3.1 8.2 / 4.0 8.8)×1
cveCVE-2026-16002
MZ Automation libIEC61850 NULL-pointer dereference DoS in L2 GOOSE/R-GOOSE parser via malformed TLV (CVSS 3.1 6.5 / 4.0 7.1)×1
cveCVE-2026-50103
MZ Automation libIEC61850 NULL-pointer dereference DoS in MMS Write Named Variable List handler (CVSS 3.1 7.5 / 4.0 8.7)×1
cveCVE-2026-50032
MZ Automation libIEC61850 stack-based buffer overflow via crafted ReadRequest (CVSS 3.1 7.5 / 4.0 8.7)×1
cveCVE-2026-50039
MZ Automation libIEC61850 unauthenticated heap-overflow RCE via crafted MMS Initiate request (CVSS 3.1 8.1 / 4.0 9.2); libIEC61850 1.0.0-1.6.1×1
cveCVE-2026-49035

Where this entity is cited

Vulns1

Source distribution

cisa.gov2 (100%)

All cited sources (2)