CVE-2022-2971 - MZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')

Back Back to CVE browser

HIGH

MZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')

Published Sep 23, 2022

8.6

HIGH

CVSS 3.1

EPSS 1.08%

Description

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload.

Affected products

Vendor MZ Automation Product libIEC61850 Default
n/a
- Version
  All
  Status
  affected
  Constraints
  <=1.4
- Version
  Version 1.5
  Status
  affected
  Constraints
  <Commit: a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MZ Automation

libIEC61850

n/a

Version	Status	Constraints
All	affected	<=1.4
Version 1.5	affected	<Commit: a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-843

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35192
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-251-01
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35192		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-251-01		x_refsource_MISCThird Party AdvisoryUS Government Resource