Heap Overflow Vulnerability in libiec61850 by MZ Automation
CVE-2024-36702

7.4HIGH

Key Information:

Vendor

MZ Automation

Status
libiec61850
Vendor
CVE Published:
11 June 2024

What is CVE-2024-36702?

A heap overflow vulnerability has been identified in libiec61850 version 1.5. The issue arises from improper handling of memory allocation in the BerEncoder_encodeLength function located in the ber_encoder.c file. Exploitation of this vulnerability may allow an attacker to corrupt memory, potentially leading to arbitrary code execution or other unintended behavior within applications utilizing this library.

References

https://github.com/mz-automation/libiec61850
https://github.com/mz-automation/libiec61850/issues/505

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.