CVE-2026-52134 Details
Description
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame.
An authentication bypass vulnerability has been identified in libiec61850 version 1.6, specifically within the parseGoosePayload() function of the GOOSE receiver. This vulnerability allows attackers to exploit the GOOSE message handling process by replaying captured GOOSE frames, which can lead to unauthorized state changes in applications that rely on this data.
To address this vulnerability, it is recommended to update the GOOSE receiver logic to properly validate the freshness of messages before processing them. This includes rejecting older 'stNum' values and non-increasing 'sqNum' values, as well as ensuring that invalid frames do not overwrite the last accepted state or trigger listener callbacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/if-forget/CVE-2026-52134-libiec61850 | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/if-forget/CVE-2026-52134-libiec61850 | [email protected] | ExploitTechnical Analysis |
| https://github.com/mz-automation/libiec61850 | [email protected] | Vendor |
| https://github.com/mz-automation/libiec61850/tree/v1.6/src/goose/goose_receiver.c | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MZ Automation GmbH libiec61850 | 1.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |