A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/mz-automation/libiec61850/commit/cfa94cbf10302bedc779703f874ee2e8387a0721 | Patch Third Party Advisory |
| https://talosintelligence.com/vulnerability_reports/TALOS-2022-1467 | Exploit Third Party Advisory |
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1467 | Exploit Third Party Advisory |
Configurations
History
25 Apr 2022, 16:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2022-1467 - Exploit, Third Party Advisory | |
| References | (MISC) https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1467 - Exploit, Third Party Advisory | |
| References | (CONFIRM) https://github.com/mz-automation/libiec61850/commit/cfa94cbf10302bedc779703f874ee2e8387a0721 - Patch, Third Party Advisory | |
| First Time |
Mz-automation libiec61850
Mz-automation |
|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CPE | cpe:2.3:a:mz-automation:libiec61850:1.5.0:*:*:*:*:*:*:* | |
| CWE | CWE-835 |
15 Apr 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Apr 2022, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-15 16:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-21159
Mitre link : CVE-2022-21159
CVE.ORG link : CVE-2022-21159
JSON object : View
Products Affected
mz-automation
- libiec61850
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')