CVE-2020-15158

Name of the Vulnerable Software and Affected Versions libIEC61850 versions prior to 1.4.3

Description The issue occurs when a message with a COTP message length field with a value less than 4 is received, leading to an integer underflow and potentially a heap buffer overflow. This can cause an application crash or, on some platforms, even the execution of remote code. The risk is higher if the application is used in open networks or if there are untrusted nodes in the network.

Recommendations For versions prior to 1.4.3, upgrade to version 1.4.3 when available. As a temporary workaround, changes from commit 033ab5b can be applied to older versions.