As reported by CISA in advisory ICSA-26-204-07, a high-severity vulnerability has been disclosed in MZ Automation's lib60870, a widely deployed open-source library implementing the IEC 60870-5 communication protocol stack — the backbone of supervisory control and data acquisition (SCADA) systems in critical infrastructure environments worldwide.
Vulnerability At a Glance
- CVE ID
- CVE-2026-16002
- CVSS v3 Score
- 8.2 — High
- Vulnerability Type
- Out-of-Bounds Read (CWE-125)
- Affected Vendor
- MZ Automation (Germany)
- Affected Product & Versions
- MZ Automation lib60870 versions ≤ 2.4.0
- Impact
- Denial of Service — parsing process crash
- Patch Available
- Yes — update to version 2.4.1 or later
- Active Exploitation Observed
- Not reported at time of disclosure
- Sectors at Risk
- Chemical, Energy, Water and Wastewater — worldwide deployment
Why This Matters More Than a Simple DoS
At first glance, a denial-of-service vulnerability might seem lower priority than remote code execution. In IT environments, that instinct is sometimes reasonable. In operational technology (OT) and industrial control system (ICS) contexts, it is dangerously wrong. lib60870 implements IEC 60870-5-101 and IEC 60870-5-104 — protocols that govern real-time telemetry, command transmission, and process data exchange between control centers and remote terminal units (RTUs) in power grids, water treatment facilities, and chemical plants.
A crashed parsing process in these environments doesn't just mean a service interruption — it can mean a control room losing visibility into field devices, automatic protective relays failing to receive commands, or safety-critical monitoring going dark. In threat modeling terms, availability is a safety property in OT environments, not merely a business continuity concern.
The true risk surface here is not just uptime — it is the potential for an adversary to deliberately blind operators during a coordinated physical or cyber attack on infrastructure.
Who Is Most Exposed
Because lib60870 is an open-source library distributed via GitHub, its true deployment footprint is difficult to quantify. It is embedded not just in first-party MZ Automation products but likely in third-party vendor solutions, custom-developed SCADA software, and integrator-built gateways. Organizations should assume exposure if they:
Attacker Perspective
The out-of-bounds read vulnerability is triggered during the parsing process, suggesting it can be reached via malformed or adversarially crafted IEC 60870-5 protocol messages. An attacker with network access to an IEC 104 TCP session — even without authentication in many legacy deployments — could repeatedly trigger crashes, achieving sustained denial of service. Given that IEC 104 frequently runs on TCP port 2404 and is sometimes exposed on routable networks or accessible via poorly segmented OT DMZs, the barrier to exploitation may be lower than operators assume.
Shield53 Recommendations
Immediate Actions
- Patch now: Update all deployments of lib60870 to version 2.4.1 or later. Consult the MZ Automation GitHub security advisory for release details.
- Inventory your lib60870 exposure: Conduct a software composition analysis (SCA) across OT environments. Check with all ICS vendors and integrators whether their products embed lib60870.
- Restrict IEC 104 access: Ensure TCP port 2404 is not exposed directly to untrusted networks. Enforce strict allowlisting at OT firewalls and data diodes where applicable.
- Enable IEC 104 protocol-aware monitoring: Deploy industrial protocol inspection at network boundaries to detect malformed or anomalous IEC 60870-5 traffic patterns indicative of exploitation attempts.
- Review authentication controls: If your IEC 104 deployment supports IEC 62351 authentication, verify it is enabled and properly configured — unauthenticated sessions dramatically expand exploitability.
Longer-Term Posture
- Establish a formal OT software bill of materials (SBOM) process to track open-source library dependencies across all vendor and integrator-supplied systems.
- Subscribe to CISA ICS advisories and MZ Automation's GitHub security notifications for ongoing vulnerability intelligence.
- Incorporate lib60870 and IEC 60870-5 protocol stack patching into your OT patch management cadence, treating availability-impacting vulnerabilities with the same urgency as remote code execution in these environments.
The disclosure of CVE-2026-16002 is a timely reminder that open-source protocol libraries embedded deep within OT product supply chains represent a significant and underappreciated attack surface. The energy and water sectors in particular should treat this patch cycle as an opportunity to audit the full breadth of their IEC 60870-5 dependencies — not just the MZ Automation implementation.
