CVE-2026-61893

MediumCVSS 6.5

Published: 30/07/2026(UTC)Updated: 23/10/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

39th percentile - higher than 39% of all known CVEs

Summary

A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.

Risk Assessment

An attacker can remotely crash the IEC 60870-5-104 handling process, disrupting communication in power automation systems and potentially causing power supply interruptions.

Recommendation

Install the update provided by the power automation system vendor that adds bounds checking in the TestCommand_getFromBuffer function.

Other vulnerabilities in IEC 60870-5-104 parser

CVE-2026-63033Medium
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.

Original NVD description (English source)

A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS