MZ Automation libIEC61850 Stack-Based Buffer Overflow
CVE-2022-2970

10CRITICAL

Key Information:

Vendor

Mz Automation

Status
Libiec61850
Vendor
CVE Published:
23 September 2022

What is CVE-2022-2970?

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.

Affected Version(s)

libIEC61850 All <= 1.4

libIEC61850 Version 1.5

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-251-01
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.