libiec61850

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. libiec61850 sits in Tier 2, which caps at $5,000; the $15,000 headline is the Tier 1 column and is not reachable here. Patches must be no more than twelve months old, submissions are rate-limited to three per person per month, and sanctions and territory exclusions apply. CVE history 7 Last 12 months 34 Lifetime Memory safety 40 % Parsing/validation 35 % Denial of service 20 % Latest advisories Loading the feed Overview libiec61850 is the dominant open-source implementation of IEC 61850, the standard for electrical substation automation, and it ships the IEC 60870-5-104 SCADA telecontrol stack alongside it. It runs in protection relays, RTUs, merging units and substation gateways across grid, rail and industrial energy equipment. This is code with physical consequence: MMS and GOOSE carry protection trips and breaker commands inside a substation. The live signal in the CVE record is the GitHub advisory stream, 7 of 8 lifetime advisories in the last twelve months, rather than the 34 NVD entries that mostly came from one 2018 fuzzing campaign against v1.3. MZ Automation pays nothing for a report, so sorona.xyz pays you directly on qualified, reproduced findings. In scope MZ Automation takes security reports as a GitHub Security Advisory on the upstream repository, and the object is the GPL-3.0 upstream tree. Nothing narrower than that tree is carved out, and everything below sits inside it MMS (Manufacturing Message Specification) ASN.1 and BER decoding in full, the primary remote attack surface and the path every network peer reaches first The IEC 61850 MMS server in full: the state machine, association handling and control-block operations, where a peer drives long-lived server state GOOSE and Sampled Values publisher and subscriber parsing over raw Ethernet, the protocols that carry protection trips and breaker commands SCL (Substation Configuration Language) XML parsing in the tooling, which ingests configuration files from outside the device The IEC 60870-5-104 telecontrol stack that ships alongside the 61850 implementation Out of scope The MZ Automation commercial fork insofar as it diverges from the GPL-3.0 upstream, which is the only object the open-source pathway covers Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail Crash-only one-liners that silence a non-exploitable abort without closing a class of defect Patches over twelve months old, which fall outside the program's age window Findings that are really about a device vendor's integration of the library rather than the library itself Patches the maintainers decline, since the reward is contingent on the merge rather than on the idea Most-valued findings Structural hardening of the MMS ASN.1/BER decoder that closes a family of length and tag-handling defects at once. Memory safety is 40% of the bug history here and the decoder is where it lives Remote memory corruption reachable before association or authentication completes, the shape a network-resident attacker inside a substation LAN would use GOOSE or Sampled Values parsing flaws, because those frames arrive on a raw Ethernet segment with no transport authentication and carry trip commands Control-block and state-machine confusion in the MMS server that lets an unauthorised peer issue or replay an operate command Bounds and entity-expansion hardening in the SCL XML parser, which processes configuration files that cross organisational boundaries during commissioning Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The cash on Google's rail is paid for a merged upstream patch rather than for a vulnerability report. A report on its own earns nothing there Submit the patch to the MZ Automation maintainers yourself and keep it merged, without reverts, for one month before claiming Patches must be no more than twelve months old when you submit them for reward Three Patch Rewards submissions per person per month is the hard cap Only the GPL-3.0 upstream qualifies; the paid MZ Automation commercial licence is a separate product and a patch confined to it is outside the open-source object Google cannot pay individuals or entities on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure Coordinated with MZ Automation through a GitHub Security Advisory on the upstream repository, which is how the project's recent disclosures have run. That matters more than usual here because the devices downstream patch on utility maintenance cycles rather than software ones. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability