PT-2024-7568 · Unknown · Libiec61850

Alice-And-Bob · Published 2024-02-19 · Updated 2025-06-10 · CVE-2024-26529

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libiec61850 versions 1.5.3 and earlier

Description The issue is related to the mmsServer handleDeleteNamedVariableListRequest() function in the libIEC61850 library, which is associated with incorrect resource cleanup or deallocation. This can be exploited by a remote attacker to cause a denial of service (DoS). The vulnerability is related to the mms named variable list service.c file in the src/mms/iso mms/server directory.

Recommendations For libiec61850 versions 1.5.3 and earlier, as a temporary workaround, consider disabling the mmsServer handleDeleteNamedVariableListRequest() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2024-08974

CVE-2024-26529

Affected Products

Libiec61850

References · 9

• https://github.com/mz-automation/libiec61850/issues/492 · Vendor Advisory
• https://github.com/mz-automation/libiec61850/issues/495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26529 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26529 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08974 · Security Note
• https://vuldb.com/?id.256694 · Note
• https://t.me/cvenotify/73690 · Telegram Post
• https://t.me/cvenotify/125286 · Telegram Post
• https://vulners.com/cve/CVE-2024-26529 · Note