Arun Babu

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists in the ACSE layer during the processing of AARQ PDUs (Application Association Request Protocol Data Units) during MMS connection establishment. An attacker can provide a length value of zero or one within the calling AP title fields, which may cause the parser to read past the end of a heap buffer. A heap buffer is a region of memory used for dynamic allocation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The MMS BER decoder contains a flaw when decoding fixed-width BER (Basic Encoding Rules) fields, specifically booleans and integers. The issue occurs because a length value supplied by an attacker is not validated, resulting in a read past the end of a heap buffer. This memory corruption leads to the termination of the MMS service process, causing a denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The MMS server connection handler contains a flaw in the processing of BER-encoded request data. When an MMS confirmed request PDU (Protocol Data Unit) containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This leads to a one byte heap out-of-bounds read, causing the MMS service process to terminate and resulting in a denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists in the ISO Presentation layer during normal mode negotiation. A missing length check when processing encoded presentation data allows a field with a zero length value to trigger a bounded heap over-read. This occurs before the establishment of an MMS (Manufacturing Message Specification) session, where a crafted TCP/102 connection attempt can cause the process to terminate, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A boundary handling flaw exists in the GOOSE payload parser. An unauthenticated attacker can trigger this issue by sending a single Layer 2 multicast frame on the process bus. The flaw occurs when an attacker-controlled inner element length exceeds its enclosing length during the processing of specific payload fields, leading the parser to perform an out-of-bounds read of one byte. This action reliably terminates the subscriber process, resulting in a denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The MMS BER decoder has a boundary-handling flaw when processing specific fields in confirmed-request messages. If a crafted BER-encoded element is sent over an established MMS session via TCP port 102, the decoder may incorrectly advance its internal read position. This leads to a heap out-of-bounds read, which causes the MMS handling process to terminate unexpectedly and results in a denial-of-service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The GOOSE parser contains an off-by-one boundary-handling flaw triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser incorrectly advances its internal buffer position, leading to a heap out-of-bounds read. This condition results in the termination of the subscriber process, causing a denial-of-service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The GOOSE subscriber component fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. An attacker can send a specially crafted GOOSE frame with an undersized timestamp field to trigger a heap out-of-bounds read during message processing. This leads to a process crash and a subsequent denial-of-service condition. A heap out-of-bounds read occurs when a program reads data past the end of the allocated memory buffer on the heap. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.