A vulnerability in the command handling of the IEC 61850 stack allows an attacker with access to IEC 61850 networks to send a specially crafted packet that can force the communication interfaces of the PM 877, CI850, and CI868 modules into fault mode or render the S+ Operations 61850 connectivity unavailable, leading to a denial‑of‑service for the affected communication functions. The weakness is a misuse of resources due to improper command validation, identified as CWE‑1284.

The affected products are ABB AC800M (System 800xA) revisions from 6.0.0x through 6.0.0303.0, from 6.1.0x through 6.1.0031.0, from 6.1.1x through 6.1.1004.0, from 6.1.1x through 6.1.1202.0, and from 6.2.0x through 6.2.0006.0; Symphony Plus SD Series models A_0, A_1, A_2.003, A_3.005, A_4.001, B_0.005; Symphony Plus MR (Melody Rack) models from 3.10 to 3.52; and S+ Operations models 2.1, 2.2, 2.3, and 3.3. The System 800xA IEC 61850 Connect variant is explicitly not affected.

The CVSS score of 7.1 indicates a moderate severity while the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires network access to the IEC 61850 domain, suggesting the attack vector is remote, within the operational network that handles IEC 61850 traffic. The impact is localized to the communication interfaces, causing denial of service for 61850 connectivity but not affecting the overall system availability or core functionality of the S+ Operations node. Given the moderate severity and the need for specialized network access, the risk to an organization with strong network segmentation may be lower, but any exposed IEC 61850 network could be a potential entry point.