CVE-2026-66720 MZ Automation GmbH CVE debrief

Who should care

Organizations using the affected GOOSE subscriber component should prioritize defensive actions to mitigate the denial-of-service vulnerability. This includes verifying and enhancing validation of UTC timestamp fields in IEC 61850 GOOSE messages, implementing compensating controls, and monitoring for potential exploitation attempts. Security teams and vulnerability management teams should focus on validating GOOSE frame timestamp fields and review compensating controls for exposed systems.

Technical summary

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE messages, allowing a specially crafted GOOSE frame to cause a heap out-of-bounds read and denial-of-service condition. This issue affects organizations using the GOOSE subscriber component, as it can lead to a denial-of-service condition. The component's improper validation of the UTC timestamp field can be exploited by a specially crafted GOOSE frame, resulting in a heap out-of-bounds read during message processing.

Defensive priority

High-priority defensive actions are required to address the denial-of-service vulnerability in the GOOSE subscriber component.

Recommended defensive actions

• Verify and enhance validation of UTC timestamp fields in IEC 61850 GOOSE messages
• Implement compensating controls to mitigate denial-of-service conditions
• Monitor for and respond to potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence is limited; verify the GOOSE subscriber component's validation of UTC timestamp fields in IEC 61850 GOOSE messages. Defenders should focus on validating GOOSE frame timestamp fields and monitor for potential exploitation attempts. Limited source details are available; further verification is required to confirm affected scope and severity.

Official resources