The vulnerability resides in parseGoosePayload() within libiec61850 v1.6, allowing an adversary who captures a GOOSE frame to deceive the library into treating the data as authenticated. This can result in unauthorized control of IEC 61850 devices, compromising confidentiality, integrity, and availability. The flaw stems from improper authentication of incoming frames, identified as CWE‑284.

The issue affects the libiec61850 library, version 1.6 as distributed by the project maintainers. Systems that deploy this library for IEC 61850 communication, particularly those handling GOOSE messages, are impacted. No other vendors or products were identified at the time of this advisory.

The CVSS score of 9.8 indicates a critical severity, but the EPSS score is below 1 %, indicating a low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to intercept or inject GOOSE frames on the network, a scenario that may be difficult but not impossible in compromised or poorly segmented networks. Given the high potential impact of unauthorized device control, operators should treat this flaw as high‑risk relative to its exploitation likelihood.