ZIV — 3 prefixes (MA-L)

A MAC address beginning 40:40:22, 40:40:28, or A4:31:11 belongs to ZIV, commercially "ZIV Automation," a Basque Country (Spain) manufacturer of digital protection, control, metering, and automation equipment for electric-utility transmission and distribution grids — typically seen on substation switches, RTUs, and protection relays, not consumer networking gear.

ZIV holds three IEEE MA-L assignments, all registered to "ZIV" at Polígono Parque Tecnológico, 210, Zamudio, Vizcaya, Spain — the same address used by the real operating company, ZIV Aplicaciones y Tecnología SL (NIF B84898741). The company reports roughly 500 employees and deployments in 85+ countries. Private-equity firm Alantra held ZIV from 2007 to 2012 before selling it to Crompton Greaves, an Indian industrial group.

ZIV's own product pages confirm genuine Ethernet hardware: the SW3 substation switch (IEC 61850-3 compliant, up to 4 Gigabit SFP bays plus 32 Fast Ethernet ports, rated for up to 8,000 MAC addresses) and the MV Flexible RTU (two Ethernet plus four serial ports, IEC 61850/101/103/104, DNP3, Modbus). ZIV also builds IEC 61850 Ed.2 protection relays — ZLF (distance protection) and IDF (transformer differential protection) — with Ethernet redundancy (RSTP/PRP/HSR) and PROCOME protocol support.

Spain's national CERT, INCIBE-CERT, coordinated disclosure of eight vulnerabilities in ZIV's IDF and ZLF relay firmware (advisory INCIBE-2025-0292, published 5 June 2025): two High-severity issues — CVE-2025-41360 (CVSS4 8.7, unauthenticated packet-flooding DoS) and CVE-2025-41361 (CVSS4 8.3, malformed-TLS reboot DoS) — plus six Medium-severity web-interface flaws. CVE-2025-41360 is independently confirmed in NVD. ZIV shipped patched firmware for all eight; no CISA ICS advisory names ZIV as of an August 2026 search, consistent with Spain-led coordination.

Don't confuse ZIV with Zivid AS, a separate Norwegian company that independently holds one unrelated IEEE MA-M block — the shared "ziv" substring is coincidental, not a corporate relationship. A Portuguese firm, WISEWARE, Lda, is a further false-positive risk: its registered address text contains the place-name string "ZIV Zona Industrial de Vagos," an unrelated Portuguese industrial park, not the Spanish company ZIV.

IEEE assignment

3 MA-L prefixes (40:40:22, 40:40:28, A4:31:11) → "ZIV", registered Zamudio, Vizcaya, Spain [Confirmed] — the IEEE MA-L registry 404022, 404028, A43111

Registry / block size

MA-L (24-bit OUI); holds exactly 3 IEEE MA-L prefixes; zero MA-M/MA-S blocks under the organization name "ZIV" [Confirmed] — the IEEE MA-L registry; cross-confirmed maclookup.app/vendors/ziv (also exactly 3 prefixes, none other)

HQ / registered address

Polígono Parque Tecnológico, 210, Zamudio, Vizcaya, ES 48170 — matches the operating company's registered address [Confirmed] — the IEEE MA-L registry; infonif.economia3.com

Company status

active — trades as "ZIV Automation," ~500 employees, deployments in 85+ countries [Confirmed] — zivautomation.com

Legal entity

ZIV Aplicaciones y Tecnología SL, NIF B84898741; current name adopted 13 Dec 2006 (previously "MISER SERVICIOS EMPRESARIALES SL") — this dates the SL's renaming, not necessarily the ZIV business's founding, which is Unknown [Likely] — infonif.economia3.com

Ownership history

private-equity firm Alantra held ZIV 2007–2012, then sold it via competitive auction to Crompton Greaves, an Indian industrial group [Likely] — alantra.com

Device types

substation Ethernet switches, RTUs/gateways, IEC 61850 protection & control relays [Confirmed] — zivautomation.com

Notable products

SW3 L2/L3 PTP substation switch (up to 4 Gigabit + 32 Fast Ethernet ports; rated up to 8,000 MAC addresses), MV Flexible RTU, ZLF distance-protection relay, IDF transformer-differential relay [Confirmed] — zivautomation.com product pages

Security history

INCIBE-CERT advisory INCIBE-2025-0292 (5 Jun 2025) disclosed 8 CVEs in IDF/ZLF firmware — 2 High (CVE-2025-41360 CVSS4 8.7; CVE-2025-41361 CVSS4 8.3) and 6 Medium; all patched. CVE-2025-41360 independently confirmed in NVD [Confirmed] — incibe.es; nvd.nist.gov

CISA cross-check

no CISA ICS advisory names ZIV as of an August 2026 search — expected, since disclosure was coordinated via Spain's INCIBE-CERT rather than CISA [Unknown, negative finding] — cisa.gov/news-events/ics-advisories

Registration date

IEEE publishes no assignment/registration date for any OUI, including these three; maclookup.app's displayed "Registration Date: 14 March 2010" is that aggregator's own database artifact, not an IEEE fact [Confirmed absence] — the IEEE MA-L registry; maclookup.app/vendors/ziv

Related vendors / disambiguation

Zivid AS (Norway) independently holds a separate MA-M block under the distinct organization name "Zivid AS" — coincidental name overlap, not affiliated [Confirmed] — the IEEE MA-M registry 4C4BF98. WISEWARE, Lda (Portugal) is a second false-positive: "ZIV" appears only inside its registered-address place-name, not as an organization name

[Confirmed] — the IEEE MA-L registry 54FB58

Analyst note

only the 3 MA-L blocks under the exact organization name "ZIV" belong to this vendor — do not fold in Zivid AS's MA-M block or any address-text substring match; organization-name identity, not string match, defines this entry [Confirmed] — the IEEE MA-L registry; the IEEE MA-M registry