{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/libiec61850-1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-52134"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["libiec61850 (1.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MZ Automation GmbH"],"content_html":"\u003cp\u003eCVE-2026-52134 affects the \u003ccode\u003eparseGoosePayload()\u003c/code\u003e function in \u003ccode\u003esrc/goose/goose_receiver.c\u003c/code\u003e of libiec61850 v1.6. Controlled experiments demonstrated that replaying captured GOOSE frames can trigger state rollbacks (where a subscriber reverts to a lower \u003ccode\u003estNum\u003c/code\u003e) or cause the library to trigger listener callbacks for messages marked as invalid.\u003c/p\u003e\n\u003ch2 id=\"prerequisites\"\u003ePrerequisites\u003c/h2\u003e\n\u003cp\u003eTo conduct the described replay behavior, an actor must be able to access the relevant IEEE 802.3 Layer 2 broadcast domain or VLAN, capture legitimate GOOSE Ethernet frames (EtherType 0x88B8), and inject frames into the network.\u003c/p\u003e\n","date_modified":"2026-10-27T01:09:36Z","date_published":"2026-10-27T01:09:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-libiec61850-goose-replay/","summary":"The libiec61850 library v1.6 fails to sufficiently reject replayed or outdated GOOSE messages, which can cause subscribers to update state or trigger callbacks with stale data.","title":"MZ Automation libiec61850: GOOSE message replay state rollback (CVE-2026-52134)","url":"https://feed.craftedsignal.io/briefs/2026-10-libiec61850-goose-replay/"}],"language":"en","title":"CraftedSignal Threat Feed - Libiec61850 (1.6)","version":"https://jsonfeed.org/version/1.1"}