by Kastro
Paper/Archive/CVE-2022-2970

CVE-2022-2970

MZ Automation libIEC61850 — MZ Automation libIEC61850 Stack-Based Buffer Overflow

EPSS 1%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 73.7.737 × 2014.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.

Affected

ProductAffectedFixed inSource
libIEC61850All – 1.4–CNA
libIEC61850Version 1.5 – < Commit: a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10eCommit: a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10eCNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-251-01