Latency-Neutral Passive Cyber Monitoring for Grid-Edge Operational Technology Networks

Deterministic industrial networks often present an operational trade-off between maintaining microsecond timing of primary control loops and capturing security telemetry. This work investigates the engineering feasibility of the Operational Technology Supervisor OTSV, a three-tier passive...

PT-2026-68491

Name of the Vulnerable Software and Affected Versions OMICRON StationGuard version 4.00 Description Improper input validation occurs during the processing of IEC 61850 Sampled Values SV frames. A specially crafted SV frame can cause the responsible process to terminate, which disrupts the...

CVE-2026-16316: Improper Input Validation

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values SV frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect...

IEC 61850 MMS identify

MMS Identify request — extract vendor/model/revision strings session preferred !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS Identify via session or direct target.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC 61850 MMS directory dump

MMS Identify plus GetNameList for domains and named variables session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS directory dump — Identify + GetNameList domains/variables.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC 61850 MMS Client

Connects to an IEC 61850 MMS server ISO-on-TCP, completes COTP + Initiate, and creates an interactive MMS shell session. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS bind listener — opens an MMS session for identify / directory.""" from kittysploit import from...

CVE-2026-52134

An issue in the parseGoosePayload() function (/goose/goose_receiver.c ) of libiec61850 v1.6 allows an attacker to bypass authentication via a captured GOOSE frame. The software fails to adequately reject replayed or stale GOOSE messages before updating the subscriber-visible state and invoking re...

CVE-2026-66720

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing,...

CVE-2026-66720

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing,...

CVE-2026-66720: Out-of-bounds Read

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing,...

IEC 61850 MMS Identify

Probe TCP/102 for IEC 61850 MMS COTP + initiate and distinguish from Siemens S7comm on the same port. !/usr/bin/env python3 -- coding: utf-8 -- """Detect IEC 61850 MMS servers on ISO-on-TCP port 102.""" from future import annotations import json from kittysploit import from...

libiec61850:fuzz_pres_userdata: Heap-buffer-overflow in parseNormalModeParameters

Project: https://github.com/mz-automation/libiec61850.git Detailed Report: https://oss-fuzz.com/testcase?key=5364411536310272 Project: libiec61850 Fuzzing Engine: libFuzzer Fuzz Target: fuzzpresuserdata Job Type: libfuzzerasanlibiec61850 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

Hitachi Energy RTU500 Infinite Loop (CVE-2026-32777)

libexpat before 2.7.5 allows an infinite loop while parsing DTD content, causing Denial of Service impact. Product is only affected if IEC 61850 functionality is configured. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Hitachi Energy RTU500 NULL Pointer Dereference (CVE-2026-32778)

libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier out-of-memory condition, causing Denial of Service impact. Product is only affected if IEC 61850 functionality is configured. This plugin only works with Tenable.ot. Please visit...

Hitachi Energy RTU500 NULL Pointer Dereference (CVE-2026-32776)

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content, causing Denial of Service impact. Product is only affected if IEC 61850 functionality is configured. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-...

Hitachi Energy RTU500 NULL Pointer Dereference (CVE-2026-24515)

In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data, causing Denial of Service impact. Product is only affected if IEC 61850 functionality is configured. This plugin only works with Tenable.ot. Please visit...

CVE-2025-3756

A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing the communication...

CVE-2025-3756 Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850

A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing the communication...

CVE-2025-3756: Improper Validation of Specified Quantity in Input

A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing the communication...

Hitachi Energy RTU500 Product Allocation of Resources Without Limits or Throttling (CVE-2025-59375)

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. Product is only affected if IEC61850 functionality is configured. This plugin only works with Tenable.ot. Please visit...