Most recent entries from all

bdu:2022-05635

EUVD-2026-230838

fkie_cve-2022-2970

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.

GHSA-h3j4-vfr6-r3jp

gsd-2022-2970

ICSA-22-251-01 — MZ Automation libIEC61850

The affected product does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.CVE-2022-2970 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The affected product is vulnerable to a stack-based buffer overflow, which could allow an attacker to crash the device or remotely execute arbitrary code. 3.2.3 ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE 843. The affected product accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload.CVE-2022-2972 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The affected product uses a NULL pointer in certain situations. which could allow an attacker to crash the server.CVE-2022-2973 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).