Read the docs
TI-2020-11930 Aliases CVE-2020-15158

Heap buffer overflow in libIEC61850

Priority MEDIUM 46CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remote code. If your application is used in open networks or there are untrusted nodes in the network it is highly recommend to apply the patch. This was patched with commit 033ab5b. Users of version 1.4.x should upgrade to version 1.4.3 when available. As a workaround changes of commit 033ab5b can be applied to older versions.

Why it matters now

EPSS 0.02036 81st percentileScored 2026-11-07
Fix Fixed libiec61850 (mz-automation): 1.4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MZ Automationlibiec61850before 1.4.31.4.3Patch availableCNA
  • libiec61850 VendorMZ Automation Affected before 1.4.3 Fixed in 1.4.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:*1.4.0 to before 1.4.3VulnerableMZ Automation
  • cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:* Versions 1.4.0 to before 1.4.3 Vulnerable ·MZ Automation

Remediation

  • Fix · CNA libiec61850 (mz-automation) Fixed in 1.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15158

References

Patch 1

Advisory 2

  • TI-2024-18824 In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the… CVSS 3.1HIGH 7.5
  • TI-2022-05561 Infinite loop in MZ Automation libiec61850 CVSS 3.1HIGH 7.5
  • TI-2024-24382 libiec61850 v1.5 was discovered to contain a heap overflow via the… CVSS 3.1HIGH 7.4
  • TI-2018-13431 An issue has been found in libIEC61850 v1.3. CVSS 3.0CRITICAL 9.8
  • TI-2022-02745 MZ Automation libIEC61850 Stack-Based Buffer Overflow CVSS 3.1CRITICAL 10.0
  • TI-2022-02743 MZ Automation libIEC61850 Stack-Based Buffer Overflow CVSS 3.1CRITICAL 10.0
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences