Scu_1Cp

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A heap-based buffer overflow exists in the MMS Protocol Workflow component within the `MmsMapping varAccessSpecToObjectReference()` function located in the `src/iec61850/common/iec61850 common.c` file. This issue occurs when the `GetNamedVariableListAttributesResponse.itemId` argument is manipulated, requiring local access to execute the attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `MmsMapping varAccessSpecToObjectReference()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A heap-based buffer overflow exists in the ASDU Element Handler component within the `SVReceiver stopThreadless()` function located in the `src/sampled values/sv subscriber.c` file. This issue allows a local attacker to trigger the overflow through specific manipulation. **Recommendations** Update to version 1.6.2. As a temporary mitigation, restrict local access to the system to prevent exploitation of the `SVReceiver stopThreadless()` function.

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A use after free issue exists in the URCB Revalidation component within the `deleteDataSetValuesShadowBuffer()` function located in the src/iec61850/server/mms mapping/reporting.c file. This flaw allows for local manipulation of the system. **Recommendations** Update to version 1.6.2.

**Name of the Vulnerable Software and Affected Versions** open62541 versions prior to 1.5.6 **Description** A heap-based buffer overflow occurs in the `UA Client readNodeClassAttribute()` function within the `src/client/ua client highlevel.c` file. This issue requires local access to be exploited. **Recommendations** Update to a version newer than 1.5.5. As a temporary workaround, restrict access to the `UA Client readNodeClassAttribute()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** open62541 (affected versions not specified) **Description** A use after free issue exists in the `UA Client getRemoteDataTypes()` function within the examples/custom datatype/client types custom.c file. A use after free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. This issue can be exploited by a local attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.