CVE-2022-1302 Malformed Goose Message in LibIEC61850 may result in a denial of service
An unauthenticated attacker can cause a denial of service in LibIEC61850 by sending a malformed Goose message.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1302?
CVE-2022-1302 is a high-severity denial of service vulnerability in MZ Automation libIEC61850, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service.
Weakness: CWE-20
Which versions are affected by CVE-2022-1302?
It affects 1 product.
Products include Mz-Automation Libiec61850.
How do I fix CVE-2022-1302?
No fix has been published for CVE-2022-1302 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-1302 being exploited?
There is no known exploitation of CVE-2022-1302 in the wild and no public exploit code.
Other vulnerabilities in MZ Automation libIEC61850
Sources
Also known as GHSA-q7jm-rf5v-pqxx.