Advisories › MZ Automation › ICSA-26-211-11
MZ Automation lib60870: 2 CVEs, Medium 6.5
Summary
CISA reports 2 vulnerabilities in MZ Automation lib60870. Weakness type: Out-of-bounds Read. Successful exploitation of these vulnerabilities could crash the device being accessed. Highest CVSS v3 score: 6.5 (Medium), exploitable over the network.
What to do: Plan: See MZ Automation advisories for more information: https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm
At a glance
- Vendor
- MZ Automation
- Products
- lib60870
- CVEs
- CVE-2026-61893, CVE-2026-63033
- Highest CVSS v3
- 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy, Water and Wastewater, Critical Manufacturing, Chemical
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-61893 | Out-of-bounds Read | 6.5 | – | No | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer. |
| CVE-2026-63033 | Out-of-bounds Read | 6.5 | – | No | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer. |
Affected products (1)
- MZ Automation GmbH lib60870: 2.4.0
Vendor fixes and mitigations (from advisory)
- Mitigation: MZ Automation recommends users update to version 2.4.1 when available.
- Vendor Fix: See MZ Automation advisories for more information: https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm link
- Vendor Fix: See MZ Automation advisory for more information: https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7 link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.