Technical impact
A crafted IEC 60870‑5‑104 I‑frame with TypeID 104 inflates the object count, causing TestCommand_getFromBuffer to read one byte past the end of the heap‑allocated message buffer. This out‑of‑bounds read may leak adjacent memory contents to an attacker, providing confidential information that could be used to further compromise the system. The weakness is classified as CWE‑125, a buffer read beyond the allocated memory, and the CVSS score of 6.9 reflects a moderate severity with a medium impact potential on confidentiality.
Affected Systems
The vulnerability exists in the MZ Automation lib60870 library. All installations running versions prior to the release of 2.4.1 are affected, as the advisory specifically targets versions before that update. No other vendors or products are listed as impacted in the CNA data.
Risk and Exploitability
The EPSS score of 0.00264 reveals a very low probability of exploitation, but the CVSS rating indicates remote exploitation is possible. Based on the description, the most likely attack vector involves an attacker sending a malicious IEC 60870‑5‑104 I‑frame over the network to a device or service that uses lib60870. Since the flaw is a simple out‑of‑bounds read on the parser, no additional authentication or privileges are required beyond network access to the relevant port. The vulnerability is not yet listed in the CISA KEV catalog. Given the CVSS score of 6.9 and the lack of public exploits, the risk is considered moderate but should be addressed promptly to reduce the attack surface.
