Hello,

I have found security (memory-safety) vulnerabilities in GuruxDLMS.c (Gurux DLMS for ANSI C) and would like to report them privately under coordinated disclosure.

Could you please either enable GitHub Private Vulnerability Reporting on the GuruxDLMS.c repository, or provide a private security contact (email)? I will then share full technical details, proof-of-concept reproducers, and suggested fixes privately.

Thank you.

Hi,
I am working with a DLMS meter that has 16 Class 7 (Profile Generic) OBIS objects.
I am able to read 12 out of the 16 Profile Generic objects successfully. However, when I try to read the remaining Profile Generic objects, I get the following error:
"Insufficient memory to continue the execution of the program."
The same meter and the same Profile Generic objects work correctly in the TALTECH/Renesas GUI, where I can read the data without any error.

Environment:

- Gurux.DLMS.NET 9.0.2605.2801 (latest release at time of writing), Gurux.Net 8.4.2604.201, .NET 8
- HDLC over TCP, SN (short-name) referencing (UseLogicalNameReferencing = false)
- Landis+Gyr E650, HDLC negotiated MaxInfoTX=128 / MaxInfoRX=62, window size 1

Hi Gurux team,

I am testing an optical probe/cable with Gurux.Serial.Android 3.0.6, which is the latest version I am currently using.

The same USB serial cable works correctly with Gurux.Serial.Java on my computer, but I am unable to get communication working with Gurux.Serial.Android.

Gurux version
Gurux.Serial.Android: 3.0.6
USB-Serial adapter details
Android detects the USB device successfully with the following information:

I'm struggling to communicate with an L&G meter. I can share the code I'm using as well as the logs. I need help.

Hello Mikko,

DLMS Director gives me an error message (something like Can't convert GXEnum to GXStructure) while reading Push Setup object.
I've made a little investigation.

Hi!

I'm successfully writing profile in 0.0.21.0.1.255 (Display profile):

pg = GXDLMSProfileGeneric("0.0.21.0.1.255")

pg.addCaptureObject(GXDLMSRegister("some.obis.code1"),2,0)
pg.addCaptureObject(GXDLMSRegister("some.obis.code2"),2,0)

reader.write(pg,3)

But when i read this profile i see that ClassID is always "03":

7E A0 37 61 02 65 74 E9 8D E6 E7 00 C4 01 C1 00 01 02 02 04 12 00 03 09 06 some.obis.code1 0F 02 12 00 00 02 04 12 00 03 09 06 some.obis.code2 0F 02 12 00 00 [CRC] 7E

We have an L+G E355 meter with a main (primary) contactor controllable via "0.0.96.3.10.255" object/attributes that works perfectly using gxDlmsDisconnectControl.(RemoteDisconnect and RemoteReconnect).
However, the meter has also has a load control (secondary low load) relay that we are still unable to control.
Do you have any suggestion around this main contactor/load relay scenario as all the topics I have viewed seem to be related to the primary contactor and that is not our issue.

GXDLMSClient.py:

Current code:
if not equals:
    raise Exception(
        "parseApplicationAssociationResponse failed. "
        + " Server to Client do not match."
    )

Should be:
# In GXDLMSClient.py imports:
from .GXDLMSException import GXDLMSException
from .enums import AssociationResult  # (add to existing 'from .enums import ...')