Summary
A critical authentication bypass in libiec61850 v1.6's GOOSE payload parsing lets attackers reuse captured GOOSE frames to be accepted as legitimate traffic.
When GOOSE frames are not rigorously authenticated, an attacker on the network can replay or craft packets that trigger unauthorized control actions in IEC 61850 environments.
Affected context
This vulnerability arises in systems that use libiec61850 v1.6 for processing GOOSE messages in protection and control devices or related gateways.
It is relevant where the parseGoosePayload() function in goose_receiver.c participates in trust decisions for incoming GOOSE frames, especially if downstream logic assumes that accepted frames are authentic.
Deployments with limited network segmentation or insufficient message-origin validation are more exposed to this issue.
Exploit preconditions
- Attack surface: IEC 61850 substation or industrial control networks carrying GOOSE traffic
- Required access: Ability to observe and inject GOOSE frames (e.g., on the same LAN or process bus)
- Trigger point: Handling of a captured or replayed GOOSE frame by
parseGoosePayload()in the receiving application - Why exploitation is possible: The parsing logic fails to enforce robust authentication or origin verification, allowing frames that mimic legitimate senders to be treated as trusted inputs
Why this happens
The underlying flaw is a broken access control pattern in the message handling path, where GOOSE frames are accepted without adequate authentication checks.
In abstract terms, the parser function treats network messages as implicitly trusted once their structure is decoded, without binding them to a verified sender identity or integrity mechanism.
This aligns with CWE-284: Improper Access Control, as the system does not correctly restrict which entities can trigger privileged operations through GOOSE traffic.
Potential impact
- Attackers may cause unauthorized switching or protection commands to be processed.
- Critical substation automation logic could be manipulated or disrupted.
- Safety margins and reliability of power or industrial processes can be degraded.
- Unauthorized changes to device state or configuration may be triggered indirectly via forged messages.
General mitigation guidance
Effective mitigation centers on strengthening message-level access control and reducing implicit trust in network frames.
Useful patterns include:
- Binding GOOSE handling to strong source authentication and integrity validation (e.g., cryptographic checks or secure association policies).
- Implementing strict authorization rules that define which senders may trigger specific actions, with explicit mapping from identity to allowed operations.
- Enforcing network segmentation, isolation, and monitoring so that GOOSE traffic from untrusted zones cannot reach control logic.
- Designing receivers to treat unauthenticated or unexpected GOOSE frames as untrusted data that cannot directly cause state changes.
How teams detect issues like this
Detection typically relies on both code-level and network-level review:
- Static analysis and code review focusing on message parsing paths that lack origin or integrity checks before acting on payloads.
- Security assessments of IEC 61850 stacks to verify that authentication and authorization are applied consistently to incoming frames.
- Policy-based checks ensuring that control logic does not assume trust merely because a frame parses successfully.
- Network monitoring to flag anomalous or replayed GOOSE frames, supported by automated tools that correlate messages with expected sender identities.
