TI-2022-17842 Aliases CVE-2022-38138 GHSA-9hvj-g625-9gj6

The Triangle Microworks IEC 61850 Library (Any client or server using the C language…

MEDIUM 41CWE-824Published 2022-10-11 · Updated 2025-04-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-824 and the CVSS impact.

Summary

The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and any client or server using the C++, C#, or Java language library with a version number of 5.0.1 or earlier) and 60870-6 (ICCP/TASE.2) Library (Any client or server using a C++ language library with a version number of 4.4.3 or earlier) are vulnerable to access given to a small number of uninitialized pointers within their code. This could allow an attacker to target any client or server using the affected libraries to cause a denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01011 63rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Triangle MicroWorks	Library: IEC 61850	Any client or server using the C language library with a version number of 11.2.0 or earlier; Any client or server using the C++, C#, or Java language library with a version number of 5.0.1 or earlier	—	No fix listed	CNA
Triangle MicroWorks	Library: IEC 60870-6 (ICCP/Tase.2)	Any client or server using a C++ language library with a version number of 4.4.3 or earlier	—	No fix listed	CNA

Library: IEC 61850 VendorTriangle MicroWorks Affected Any client or server using the C language library with a version number of 11.2.0 or earlier; Any client or server using the C++, C#, or Java language library with a version number of 5.0.1 or earlier Fixed in — No fix listed CNA
Library: IEC 60870-6 (ICCP/Tase.2) VendorTriangle MicroWorks Affected Any client or server using a C++ language library with a version number of 4.4.3 or earlier Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:trianglemicroworks:iec_60870-6_software_library:-:::::::*	not specified by NVD	Vulnerable	Triangle MicroWorks
cpe:2.3:a:trianglemicroworks:iec_61850_software_library:-:::::::*	not specified by NVD	Vulnerable	Triangle MicroWorks

cpe:2.3:a:trianglemicroworks:iec_60870-6_software_library:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Triangle MicroWorks
cpe:2.3:a:trianglemicroworks:iec_61850_software_library:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Triangle MicroWorks

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-38138
2026-10-03 Alias added: GHSA-9hvj-g625-9gj6

References

Advisory 1

https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-01

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences