CVE-2026-19259 | Medium | 5.3 | 2026-08-08 | A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping_varAccessSpecToObjectReference of the… |
CVE-2026-19206 | Medium | 5.3 | 2026-08-07 | A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_value… |
CVE-2026-19108 | Medium | 5.3 | 2026-08-06 | A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec618… |
CVE-2026-18583 | Medium | 5.3 | 2026-08-03 | A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms… |
CVE-2026-18582 | Medium | 5.3 | 2026-08-03 | A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAccessHandler of the fi… |
CVE-2026-63033 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding
what fits in the ASDU body causes InformationObject_ParseObjectAddress
to read one b… |
CVE-2026-61893 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an
inflated object count causes TestCommand_getFromBuffer to read one byte
past the end of… |
CVE-2026-50103 | Medium | 6.5 | 2026-07-23 | A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending… |
CVE-2026-50039 | High | 7.5 | 2026-07-23 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request. |
CVE-2026-50032 | High | 7.5 | 2026-07-23 | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequ… |
CVE-2026-49035 | High | 8.1 | 2026-07-23 | The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when A… |
CVE-2026-16002 | High | 8.2 | 2026-07-23 | The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service. |
CVE-2024-45971 | Critical | 9.8 | 2024-11-15 | Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cau… |
CVE-2024-45970 | Critical | 9.8 | 2024-11-15 | Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cau… |
CVE-2024-36702 | High | 7.4 | 2024-06-11 | libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c. |
CVE-2024-28286 | High | 7.5 | 2024-03-21 | In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_f… |
CVE-2024-26529 | High | 7.5 | 2024-03-13 | An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer_handleDeleteNamedVariab… |
CVE-2024-25366 | Medium | 6.2 | 2024-02-20 | Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameList… |
CVE-2023-27772 | High | 7.5 | 2023-04-13 | libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c. |
CVE-2023-23205 | Medium | 5.5 | 2023-02-24 | An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multi_client_server/multi_client_server.c. |
CVE-2022-3976 | Medium | 5.5 | 2022-11-13 | A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/i… |
CVE-2022-2973 | High | 8.6 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) uses a NULL pointer in certain situa… |
CVE-2022-2972 | Critical | 10.0 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) is vulnerable to a stack-based buffe… |
CVE-2022-2971 | High | 8.6 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) accesses a resource using an incompa… |
CVE-2022-2970 | Critical | 10.0 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcp… |
CVE-2022-21159 | High | 7.5 | 2022-04-15 | A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of… |
CVE-2022-1302 | High | 7.5 | 2022-04-12 | In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service. |
CVE-2021-45773 | High | 7.5 | 2022-01-14 | A NULL pointer dereference in CS104_IPAddress_setFromString at src/iec60870/cs104/cs104_slave.c of lib60870 commit 0d5e76e can lead to a segmentation fault or… |
CVE-2021-45769 | High | 7.5 | 2022-01-14 | A NULL pointer dereference in AcseConnection_parseMessage at src/mms/iso_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation fault or application cras… |
CVE-2021-21778 | High | 7.5 | 2021-08-25 | A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET 2.2.0. A specially crafted network req… |
CVE-2020-15158 | High | 7.7 | 2020-08-26 | In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap… |
CVE-2020-7054 | High | 8.8 | 2020-01-14 | MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing the MMS_BIT_STRING… |
CVE-2019-19958 | Medium | 6.5 | 2019-12-24 | In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive… |
CVE-2019-19957 | Medium | 6.5 | 2019-12-24 | In libIEC61850 1.4.0, getNumberOfElements in mms/iso_mms/server/mms_access_result.c has an out-of-bounds read vulnerability, related to bufPos and elementLengt… |
CVE-2019-19944 | Medium | 6.5 | 2019-12-23 | In libIEC61850 1.4.0, BerDecoder_decodeUint32 in mms/asn1/ber_decode.c has an out-of-bounds read, related to intLen and bufPos. |
CVE-2019-19931 | High | 8.8 | 2019-12-23 | In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow. |
CVE-2019-19930 | Medium | 6.5 | 2019-12-23 | In libIEC61850 1.4.0, MmsValue_newOctetString in mms/iso_mms/common/mms_value.c has an integer signedness error that can lead to an attempted excessive memory… |
CVE-2019-16510 | High | 7.5 | 2019-09-19 | libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose. |
CVE-2019-1010300 | High | 7.5 | 2019-07-15 | mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The… |
CVE-2019-6719 | High | 7.5 | 2019-01-23 | An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/iso_server/iso_server.c, as demonstrated by examples/s… |
CVE-2019-6138 | High | 7.5 | 2019-01-11 | An issue has been found in libIEC61850 v1.3.1. Memory_malloc and Memory_calloc in hal/memory/lib_memory.c have memory leaks when called from mms/iso_mms/common… |
CVE-2019-6137 | High | 7.5 | 2019-01-11 | An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference. |
CVE-2019-6136 | High | 7.5 | 2019-01-11 | An issue has been found in libIEC61850 v1.3.1. Ethernet_setProtocolFilter in hal/ethernet/linux/ethernet_linux.c has a SEGV, as demonstrated by sv_subscriber_e… |
CVE-2019-6135 | High | 7.5 | 2019-01-11 | An issue has been found in libIEC61850 v1.3.1. Memory_malloc in hal/memory/lib_memory.c has a memory leak when called from Asn1PrimitiveValue_create in mms/asn… |
CVE-2018-19185 | Critical | 9.8 | 2018-11-12 | An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoder_encodeOctetString in mms/asn1/ber_encoder.c. This is exploitable… |
CVE-2018-19122 | Medium | 4.3 | 2018-11-09 | An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in Ethernet_sendPacket in ethernet_bsd.c. |
CVE-2018-19121 | Medium | 4.3 | 2018-11-09 | An issue has been found in libIEC61850 v1.3. It is a SEGV in Ethernet_receivePacket in ethernet_bsd.c. |
CVE-2018-19093 | High | 7.5 | 2018-11-07 | An issue has been found in libIEC61850 v1.3. It is a SEGV in ControlObjectClient_setCommandTerminationHandler in client/client_control.c. NOTE: the software ma… |
CVE-2018-18957 | Critical | 9.8 | 2018-11-05 | An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in goose/goose_publisher.c. |
CVE-2018-18937 | High | 7.5 | 2018-11-05 | An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSet_getValues in client/ied_connection.c. |
CVE-2018-18834 | Critical | 9.8 | 2018-10-30 | An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoder_encodeOctetString in mms/asn1/ber_encoder.c. |