CISA published advisory ICSA-26-211-11 on 30 July 2026, covering two out-of-bounds read defects in MZ Automation's lib60870, version 2.4.0, tracked as CVE-2026-61893 and CVE-2026-63033. Both reached the agency from a researcher at the Central Power Research Institute in Bengaluru, which is to say from a power research body rather than a product security team.
lib60870 is not something that appears in an asset register under its own name. It is a library implementing IEC 60870-5-104, the telecontrol protocol that carries measurements and commands between substation gateways, RTUs and a control centre, and vendors compile it into their own firmware. The version number that matters therefore sits inside somebody else's build. CISA records the deployment as worldwide and puts energy, chemical, critical manufacturing, and water and wastewater in scope, with the vendor based in Germany.
Both defects are the same error made in two places on the parsing path. In the first, an I-frame carrying TypeID 104, the test command, declares more information objects than the frame actually holds, and the handler reads a single byte past the end of the heap buffer holding the message. In the second, a declared object count larger than the ASDU body can carry sends the information object address routine one byte beyond the same boundary.
A one-byte overread is a small primitive, and the scoring reflects that. CISA states the consequence of successful exploitation is a crash of the device being reached. Both entries carry a CVSS v3.1 base score of 6.5 and a v4.0 score of 6.9, with vectors describing a network attack of low complexity that needs no credentials and no user interaction.
For a control room, a crash on that link is not a data quality problem. It is the point at which telemetry from a substation stops arriving and commands stop landing, until whatever runs the protocol stack is back. On a mine carrying its own reticulation and a few intake substations, that is a supervisor working the phone instead of the mimic, and an unplanned call-out on plant nobody had scheduled. Because no login is involved, anything able to open a 104 session to the device can attempt it.
The remediation is where this gets awkward. MZ Automation's fix is version 2.4.1, and the advisory frames it as a release to move to when it becomes available rather than as a build anyone holds today. CISA refers readers to a vendor security advisory on GitHub for each defect. It closes with the agency's standing segmentation and remote access guidance, and records no reports to CISA of public exploitation aimed at either issue.
What the advisory does not do is name the products that embed the library. An operator running a third-party gateway or protocol converter cannot read this document and place themselves inside or outside the affected set, because that answer sits with whoever compiled the firmware and has not been published here. Until 2.4.1 exists and works through those vendors' release cycles, the fixed version is not a thing an operator can install, and the only quantity that changes in the meantime is how many devices can be reached with a 104 frame at all.
Source
- cisa.gov/news-events/ics-advisories/icsa-26-211-11