Cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amz_automationlibiec61850/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 01:09:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMZ Automation libiec61850: GOOSE message replay state rollback (CVE-2026-52134)https://feed.craftedsignal.io/briefs/2026-10-libiec61850-goose-replay/Tue, 27 Oct 2026 01:09:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-libiec61850-goose-replay/The libiec61850 library v1.6 fails to sufficiently reject replayed or outdated GOOSE messages, which can cause subscribers to update state or trigger callbacks with stale data.CVE-2026-52134 affects the parseGoosePayload() function in src/goose/goose_receiver.c of libiec61850 v1.6. Controlled experiments demonstrated that replaying captured GOOSE frames can trigger state rollbacks (where a subscriber reverts to a lower stNum) or cause the library to trigger listener callbacks for messages marked as invalid.

Prerequisites

To conduct the described replay behavior, an actor must be able to access the relevant IEEE 802.3 Layer 2 broadcast domain or VLAN, capture legitimate GOOSE Ethernet frames (EtherType 0x88B8), and inject frames into the network.

]]>highadvisory