CVE-2021-21778
📋 TL;DR
This vulnerability allows unauthenticated attackers to cause denial of service by sending specially crafted ASDU messages to lib60870.NET implementations, disrupting communications in industrial control systems. It affects systems using MZ Automation's lib60870.NET library version 2.2.0 for IEC 60870-5 protocol implementations.
💻 Affected Systems
- MZ Automation GmbH lib60870.NET
📦 What is this software?
Lib60870 by Mz Automation
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of communications in critical infrastructure systems, potentially disrupting power grid operations or industrial processes.
Likely Case
Temporary communication disruption requiring system restart or manual intervention to restore functionality.
If Mitigated
Limited impact with proper network segmentation and monitoring, though service interruption may still occur.
🎯 Exploit Status
The vulnerability is well-documented with proof-of-concept available, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.1 or later
Vendor Advisory: https://www.mz-automation.de/downloads/
Restart Required: Yes
Instructions:
1. Download lib60870.NET version 2.2.1 or later from MZ Automation website. 2. Replace the vulnerable library files. 3. Restart affected applications/services. 4. Test communications functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to lib60870.NET services using firewalls or network ACLs.
Rate Limiting
allImplement rate limiting on ASDU message processing to reduce DoS impact.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems from untrusted networks.
- Deploy intrusion detection systems to monitor for ASDU message anomalies and block malicious traffic.
🔍 How to Verify
Check if Vulnerable:
Check application dependencies for lib60870.NET version 2.2.0. Review system logs for ASDU processing errors or communication disruptions.Check Version:
Check application configuration files or use .NET assembly inspection tools to verify lib60870.NET version.Verify Fix Applied:
Verify lib60870.NET version is 2.2.1 or later. Test ASDU message processing functionality under normal and stress conditions.📡 Detection & Monitoring
Log Indicators:
- ASDU message processing errors
- Unexpected communication disruptions
- High volume of malformed network packets
Network Indicators:
- Unusual ASDU message patterns
- Traffic spikes to IEC 60870-5 ports (typically 2404/TCP)
- Malformed protocol packets
SIEM Query:
source="network_traffic" dest_port=2404 AND packet_size>normal AND protocol="iec60870"