CVE-2026-63550

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63550", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-07-27T19:32:49.393Z", "datePublished": "2026-07-30T22:43:21.063Z", "dateUpdated": "2026-07-31T15:57:05.901Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-07-30T22:43:21.063Z"}, "title": "MZ Automation libiec61850 Out-of-bounds Read", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-125", "description": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "MZ Automation GmbH", "product": "libiec61850", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.2", "versionType": "custom"}, {"status": "unaffected", "version": "1.6.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service."}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "MZ Automation GmbH recommends that users update to version 1.6.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "MZ Automation GmbH recommends that users update to version 1.6.2."}]}], "credits": [{"lang": "en", "value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA.", "type": "finder"}], "source": {"advisory": "ICSA-26-211-10", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T15:55:55.366699Z", "id": "CVE-2026-63550", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:57:05.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63550", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T15:55:55.366699Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:56:58.192Z"}}], "cna": {"title": "MZ Automation libiec61850 Out-of-bounds Read", "source": {"advisory": "ICSA-26-211-10", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MZ Automation GmbH", "product": "libiec61850", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.2", "versionType": "custom"}, {"status": "unaffected", "version": "1.6.2"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "MZ Automation GmbH recommends that users update to version 1.6.2.", "supportingMedia": [{"type": "text/html", "value": "MZ Automation GmbH recommends that users update to version 1.6.2.", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service.", "supportingMedia": [{"type": "text/html", "value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-07-30T22:43:21.063Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63550", "state": "PUBLISHED", "dateUpdated": "2026-07-31T15:57:05.901Z", "dateReserved": "2026-07-27T19:32:49.393Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-07-30T22:43:21.063Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "libiec61850", "vendor": "MZ Automation GmbH", "versions": [{"lessThan": "1.6.2", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "1.6.2"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service."}, {"lang": "es", "value": "El decodificador BER de MMS contiene una falla en el manejo de l\u00edmites en el procesamiento de ciertos campos dentro de mensajes de solicitud confirmada. Cuando se recibe un elemento BER codificado y manipulado a trav\u00e9s de una sesi\u00f3n MMS establecida (puerto TCP 102), el decodificador puede avanzar su posici\u00f3n de lectura interna incorrectamente, lo que lleva a una lectura fuera de l\u00edmites de la pila. Esta condici\u00f3n causa que el proceso de manejo de MMS termine inesperadamente, lo que resulta en una denegaci\u00f3n de servicio."}], "id": "CVE-2026-63550", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63550", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T15:55:55.366699Z", "version": "2.0.3"}}]}, "published": "2026-07-30T23:16:52.443", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.6.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "libiec61850", "source": "cna", "vendor": "MZ Automation GmbH"}, "product": "libiec61850", "vendor": "mz-automation"}], "created": "2026-07-31T00:30:18.316785+00:00", "updated": "2026-08-03T10:30:18.413193+00:00", "vendors": ["mz-automation", "mz-automation$PRODUCT$libiec61850"]}