CVE-2022-2970: MZ Automation libIEC61850 Stack-Based Buffer Overflow
MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2970?
CVE-2022-2970 has a high severity rating due to its potential for remote code execution and device crashes.
How do I fix CVE-2022-2970?
To fix CVE-2022-2970, upgrade libIEC61850 to version 1.5.0 or later, ensuring you include all relevant commits.
What types of attacks can be conducted using CVE-2022-2970?
CVE-2022-2970 allows attackers to crash devices or execute arbitrary code remotely.
Which versions of libIEC61850 are affected by CVE-2022-2970?
CVE-2022-2970 affects libIEC61850 versions 1.4 and all versions of 1.5 prior to a specific commit.
Is user input a factor in CVE-2022-2970?
Yes, CVE-2022-2970 involves insufficient input sanitization before executing memory copy operations.