CVE-2026-52134 Overview
CVE-2026-52134 is an authentication bypass vulnerability in the parseGoosePayload() function located at /goose/goose_receiver.c in libiec61850 version 1.6. The library implements the IEC 61850 protocol suite used in electrical substation automation and industrial control systems. Attackers can bypass authentication by replaying a captured Generic Object Oriented Substation Event (GOOSE) frame, allowing unauthorized message injection into the protocol stack. The flaw is classified under [CWE-284: Improper Access Control] and affects network-reachable deployments of the library.
Critical Impact
A remote attacker with network access to GOOSE traffic can bypass authentication by capturing and replaying a valid frame, undermining the integrity of substation communications.
Affected Products
- libiec61850 v1.6 (goose_receiver.c)
- Industrial control system (ICS) applications integrating libiec61850 for GOOSE messaging
- IEC 61850-based substation automation deployments that rely on the affected release
Discovery Timeline
- 2026-07-31 - CVE-2026-52134 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-52134
Vulnerability Analysis
The defect lives in the parseGoosePayload() routine of libiec61850's GOOSE receiver. GOOSE is a publisher-subscriber protocol defined by IEC 61850 for exchanging time-critical status and control data between intelligent electronic devices (IEDs) in electrical substations. The parsing routine fails to properly enforce authentication checks on incoming GOOSE frames. As a result, a previously observed frame can be resubmitted and accepted as legitimate. The exploitability score reflects a network-reachable attack surface without prior credentials or user interaction, and the EPSS probability sits at 0.8% with a 53rd percentile ranking.
Root Cause
The root cause is improper access control in the frame validation path. parseGoosePayload() does not sufficiently validate authentication metadata or reject replayed frames before processing payload contents. Because GOOSE traffic is typically transmitted on a Layer 2 multicast channel within substation networks, any attacker with access to that segment can capture frames and replay them without needing to forge cryptographic material.
Attack Vector
An attacker positioned on a network segment carrying GOOSE traffic captures a valid frame and retransmits it. The receiver accepts the frame, treating the sender as authenticated. This enables unauthorized command injection into control workflows, potentially triggering protective relay operations, breaker actions, or misleading state changes in downstream logic. The vulnerability requires no privileges and no interaction from operators.
No verified exploit code is published in the enriched dataset beyond the proof-of-concept repository. Reviewers should consult the affected source file for details on the parsing flow.
Detection Methods for CVE-2026-52134
Indicators of Compromise
- Duplicate GOOSE frames with identical stNum and sqNum values arriving from unexpected MAC addresses or at unusual intervals.
- GOOSE state transitions that do not correlate with legitimate IED events or operator actions.
- Unexpected trip, block, or interlock signals in substation SCADA historian logs.
Detection Strategies
- Deploy passive GOOSE traffic monitoring that tracks publisher goID, stNum, and sqNum sequencing and alerts on regressions or replays.
- Enable IEC 62351-6 message authentication where supported by publishers and subscribers to detect frames lacking valid signatures.
- Correlate GOOSE anomalies with process-bus telemetry to identify frames that do not match observed primary equipment state.
Monitoring Recommendations
- Baseline normal GOOSE publisher-subscriber pairs and alert on any new sources appearing on station or process bus VLANs.
- Log all GOOSE parsing errors and authentication failures from libiec61850-based applications for review.
- Instrument port mirroring on substation switches so replayed frames can be captured and analyzed post-incident.
How to Mitigate CVE-2026-52134
Immediate Actions Required
- Inventory all applications and IEDs that link against libiec61850 v1.6 and identify those exposed to shared or routed GOOSE networks.
- Restrict GOOSE traffic to dedicated, isolated VLANs with strict switch port access control lists (ACLs).
- Enable IEC 62351-6 authentication on publishers and subscribers where the deployment supports it.
Patch Information
At the time of publication, the NVD entry does not reference a fixed release. Monitor the libiec61850 project repository for an upstream patch addressing parseGoosePayload() and upgrade once a fixed version is issued.
Workarounds
- Segment GOOSE traffic onto isolated Layer 2 domains that are not reachable from corporate or engineering networks.
- Apply switch-level MAC address filtering and 802.1X authentication on substation LAN ports to limit which devices can publish GOOSE frames.
- Deploy intrusion detection sensors tuned to IEC 61850 protocol semantics to alert on replayed or out-of-sequence frames.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
