IEC 61850 security: what GOOSE, Sampled Values and MMS do and don't protect

IEC 61850, "Communication networks and systems for power utility automation," is the IEC Technical Committee 57 (TC 57) series that standardizes how intelligent electronic devices (IEDs) inside a substation — protection relays, bay controllers, merging units — exchange data with each other and with a station-level SCADA system. IEC's own bundled catalogue listing (IEC 61850:2026 SER) counts 47 distinct publications spanning the core parts, functional data models, communication service mappings and technical reports, maintained by TC 57 and first published (as "Communication networks and systems in substations") in the mid-2000s. The standard was built for an era when substation networks were isolated and proprietary, and its two fastest, most time-critical message types — GOOSE and Sampled Values — carry no authentication or encryption of their own in their base specifications (IEC 61850-8-1 for GOOSE, IEC 61850-9-2 for Sampled Values). Security for IEC 61850 traffic is instead the job of a separate standard, IEC 62351-6, bolted on afterward rather than built in from the start.

Timing. GOOSE carries protection and control events (like a circuit breaker trip command) and Sampled Values carry a continuous stream of time-synchronized current/voltage measurements, and both run as Layer 2 Ethernet multicast frames with delivery deadlines in the single-digit milliseconds — fast enough that full encryption's added processing latency can jeopardize the real-time guarantee the protocols exist to provide. Widely corroborated independent technical analysis of the published IEC 62351-6:2020 standard (this guide has not purchased the full paywalled text) describes the chosen tradeoff: instead of encrypting payload, Part 6 relies on message authentication — an HMAC or AES-GMAC computed over a pre-shared group key — to protect the integrity and authenticity of GOOSE and Sampled Values frames without adding full encryption's latency. A separate mechanism, IEC TR 61850-90-5, defines a routable variant (R-GOOSE and R-SV, carried over UDP/IP for wide-area protection and synchrophasor applications beyond a single substation LAN) with its own security options — none, signature, or signature-plus-encryption — keyed through the GDOI group-key protocol IEC 62351-9 extends for this purpose. Treat the specific cryptographic parameters as **to be confirmed** against the purchased IEC text before an implementation decision; our [IEC 62351 guide](/guides/iec-62351-power-systems-communications-security/) covers the full security series part by part.

Two unrelated vulnerability classes, both in vendor implementations rather than in the IEC 61850 base protocol or IEC 62351's security design. CISA's ICSA-26-211-10 (released 30 July 2026) covers MZ Automation GmbH's open-source libiec61850 stack, versions before 1.6.2: eight separate CVEs (CVE-2026-66720, -66369, -63550, -65421, -66364, -66349, -56758 and -66360), all classified CWE-125 Out-of-Bounds Read, with CVSS v3.1 scores of 6.5 or 7.5 and v4.0 scores up to 8.7. Per CISA's description, the most representative of the eight is a GOOSE subscriber flaw where "a specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing, causing the process to crash" — a single unauthenticated Layer-2 multicast frame on the process bus is enough, since GOOSE has no sender authentication to prevent an untrusted frame from reaching the parser in the first place. CISA's ICSA-26-120-01 (released 30 April 2026, initial 13 April 2026) covers ABB System 800xA and Symphony Plus products' IEC 61850 MMS-client communication stack — CVE-2025-3756, CVSS v3.1 6.5 (CWE-1284, Improper Validation of Specified Quantity in Input) — where an attacker with IEC 61850 network access can send a specially crafted packet to force affected Communication Interfaces (CI868/AC800M, CI850, PM 877, S+ Operations) into fault mode, a denial-of-service condition; CISA's advisory is explicit that GOOSE communication itself is not impacted by this particular finding.

Inventory every IED, merging unit, bay controller and station computer that speaks GOOSE, Sampled Values or MMS, along with the exact firmware/software version of each — none of the findings above, or any future advisory, can be assessed without that detail, and the ABB and MZ Automation findings above each affect only specific version ranges. Confirm whether IEC 62351-6 message authentication is actually configured on your GOOSE/SV traffic rather than assuming the standard's existence on paper means it is active in your substation — per FieldComm-style industry practice elsewhere in OT, security features that exist in a specification are routinely shipped disabled by default. Patch libiec61850-based and ABB IEC 61850 products against the CVEs above (MZ Automation recommends updating to 1.6.2; ABB's patch timeline runs from S+ Operations 3.4, released January 2026, through CI868's planned Q2 2027 fix) or any newer CISA ICS advisory matching your exact product and version. Segment substation LANs carrying GOOSE/SV/MMS traffic from business networks and the internet, since IEC 61850 traffic was never designed to be exposed outside a trusted local network, and ABB's own advisory recommends firewalling control networks and using a VPN for any required remote access rather than direct exposure.