CVE-2024-26529
📋 TL;DR
A vulnerability in mz-automation libiec61850 versions 1.5.3 and earlier allows remote attackers to cause denial of service (DoS) by exploiting the mmsServer_handleDeleteNamedVariableListRequest function. This affects systems using the libiec61850 library for IEC 61850 protocol communication in industrial control and energy management systems.
💻 Affected Systems
- mz-automation libiec61850
📦 What is this software?
Libiec61850 by Mz Automation
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of IEC 61850 communication services, potentially affecting industrial control systems and energy grid operations.
Likely Case
Service crashes or hangs requiring manual restart, disrupting monitoring and control functions.
If Mitigated
Limited impact with proper network segmentation and monitoring, allowing quick detection and recovery.
🎯 Exploit Status
Remote exploitation without authentication, though specific exploit details not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.4 or later
Vendor Advisory: https://github.com/mz-automation/libiec61850/issues/492
Restart Required: Yes
Instructions:
1. Update libiec61850 to version 1.5.4 or later. 2. Recompile applications using the library. 3. Restart affected services.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to IEC 61850 services to trusted sources only.
iptables -A INPUT -p tcp --dport 102 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 102 -j DROP
Service Restriction
allDisable unnecessary MMS server functionality if not required.
Configure MMS server to disable named variable list services if not needed
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy intrusion detection systems monitoring for abnormal IEC 61850 traffic
🔍 How to Verify
Check if Vulnerable:
Check libiec61850 version: dpkg -l | grep libiec61850 or rpm -qa | grep libiec61850Check Version:
pkg-config --modversion libiec61850Verify Fix Applied:
Confirm version is 1.5.4 or later and test MMS server functionality📡 Detection & Monitoring
Log Indicators:
- MMS server crashes
- Abnormal termination of IEC 61850 services
- Repeated connection attempts to port 102
Network Indicators:
- Unusual traffic patterns to IEC 61850 port 102
- Multiple deleteNamedVariableList requests
SIEM Query:
source="*iec61850*" AND (event="crash" OR event="terminated")