CVE-2026-63033 MZ Automation CVE debrief

Who should care

Organizations using IEC 60870-5-104 protocol implementations, particularly in industrial control systems, should be aware of this vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also conduct inventory checks to identify potentially affected systems and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability exists in the InformationObject_ParseObjectAddress function, which reads one byte past the end of a heap-allocated message buffer when encountering a crafted IEC 60870-5-104 I-frame with an excessive declared object count. This could lead to information disclosure or system crash. The affected product context is IEC 60870-5-104 protocol implementations, particularly in industrial control systems. Defenders should focus on verifying and applying vendor patches or updates, and implementing compensating controls.

Defensive priority

Medium priority given the potential for information disclosure or system crash.

Recommended defensive actions

• Verify and apply vendor patches or updates.
• Implement compensating controls, such as monitoring and exception tracking.
• Conduct inventory checks to identify potentially affected systems.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The evidence for this CVE is limited. Verification with official records and vendor statements is recommended. A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer. Defenders should verify the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Official resources