ZIV — 3 prefixes (MA-L)

A MAC address beginning 40:40:22, 40:40:28, or A4:31:11 belongs to ZIV, commercially "ZIV Automation," a Basque Country (Spain) manufacturer of digital protection, control, metering, and automation equipment for electric-utility transmission and distribution grids — typically seen on substation switches, RTUs, and protection relays, not consumer networking gear.

ZIV holds three IEEE MA-L assignments, all registered to "ZIV" at Polígono Parque Tecnológico, 210, Zamudio, Vizcaya, Spain — the same address used by the real operating company, ZIV Aplicaciones y Tecnología SL (NIF B84898741). The company reports roughly 500 employees and deployments in 85+ countries. Private-equity firm Alantra held ZIV from 2007 to 2012 before selling it to Crompton Greaves, an Indian industrial group.

ZIV's own product pages confirm genuine Ethernet hardware: the SW3 substation switch (IEC 61850-3 compliant, up to 4 Gigabit SFP bays plus 32 Fast Ethernet ports, rated for up to 8,000 MAC addresses) and the MV Flexible RTU (two Ethernet plus four serial ports, IEC 61850/101/103/104, DNP3, Modbus). ZIV also builds IEC 61850 Ed.2 protection relays — ZLF (distance protection) and IDF (transformer differential protection) — with Ethernet redundancy (RSTP/PRP/HSR) and PROCOME protocol support.

Spain's national CERT, INCIBE-CERT, coordinated disclosure of eight vulnerabilities in ZIV's IDF and ZLF relay firmware (advisory INCIBE-2025-0292, published 5 June 2025): two High-severity issues — CVE-2025-41360 (CVSS4 8.7, unauthenticated packet-flooding DoS) and CVE-2025-41361 (CVSS4 8.3, malformed-TLS reboot DoS) — plus six Medium-severity web-interface flaws. CVE-2025-41360 is independently confirmed in NVD. ZIV shipped patched firmware for all eight; no CISA ICS advisory names ZIV as of an August 2026 search, consistent with Spain-led coordination.

Don't confuse ZIV with Zivid AS, a separate Norwegian company that independently holds one unrelated IEEE MA-M block — the shared "ziv" substring is coincidental, not a corporate relationship. A Portuguese firm, WISEWARE, Lda, is a further false-positive risk: its registered address text contains the place-name string "ZIV Zona Industrial de Vagos," an unrelated Portuguese industrial park, not the Spanish company ZIV.

Location

Polígono Parque Tecnológico, 210, Zamudio, Vizcaya, ES 48170 (IEEE registry address)

Device class

Substation Ethernet switches, RTUs, and IEC 61850 protection/control relays for utility HV/MV/LV grids

OUI prefixes

40:40:22, 40:40:28, A4:31:11 — all MA-L, all registered to organization name "ZIV"

Not to be confused with

Zivid AS (Norway) — a separate company holding an unrelated MA-M block

Security history

8 CVEs patched (INCIBE-2025-0292, June 2025); flagship CVE-2025-41360 confirmed in NVD

IEEE assignment

3 MA-L prefixes (40:40:22, 40:40:28, A4:31:11) → "ZIV", registered Zamudio, Vizcaya, Spain [Confirmed] — the IEEE MA-L registry 404022, 404028, A43111

Registry / block size

MA-L (24-bit OUI); holds exactly 3 IEEE MA-L prefixes; zero MA-M/MA-S blocks under the organization name "ZIV" [Confirmed] — the IEEE MA-L registry; cross-confirmed maclookup.app/vendors/ziv (also exactly 3 prefixes, none other)

HQ / registered address

Polígono Parque Tecnológico, 210, Zamudio, Vizcaya, ES 48170 — matches the operating company's registered address [Confirmed] — the IEEE MA-L registry; infonif.economia3.com

Company status

active — trades as "ZIV Automation," ~500 employees, deployments in 85+ countries [Confirmed] — zivautomation.com

Legal entity

ZIV Aplicaciones y Tecnología SL, NIF B84898741; current name adopted 13 Dec 2006 (previously "MISER SERVICIOS EMPRESARIALES SL") — this dates the SL's renaming, not necessarily the ZIV business's founding, which is Unknown [Likely] — infonif.economia3.com

Ownership history

private-equity firm Alantra held ZIV 2007–2012, then sold it via competitive auction to Crompton Greaves, an Indian industrial group [Likely] — alantra.com

Device types

substation Ethernet switches, RTUs/gateways, IEC 61850 protection & control relays [Confirmed] — zivautomation.com

Notable products

SW3 L2/L3 PTP substation switch (up to 4 Gigabit + 32 Fast Ethernet ports; rated up to 8,000 MAC addresses), MV Flexible RTU, ZLF distance-protection relay, IDF transformer-differential relay [Confirmed] — zivautomation.com product pages

Security history

INCIBE-CERT advisory INCIBE-2025-0292 (5 Jun 2025) disclosed 8 CVEs in IDF/ZLF firmware — 2 High (CVE-2025-41360 CVSS4 8.7; CVE-2025-41361 CVSS4 8.3) and 6 Medium; all patched. CVE-2025-41360 independently confirmed in NVD [Confirmed] — incibe.es; nvd.nist.gov

CISA cross-check

no CISA ICS advisory names ZIV as of an August 2026 search — expected, since disclosure was coordinated via Spain's INCIBE-CERT rather than CISA [Unknown, negative finding] — cisa.gov/news-events/ics-advisories

Registration date

IEEE publishes no assignment/registration date for any OUI, including these three; maclookup.app's displayed "Registration Date: 14 March 2010" is that aggregator's own database artifact, not an IEEE fact [Confirmed absence] — the IEEE MA-L registry; maclookup.app/vendors/ziv

Related vendors / disambiguation

Zivid AS (Norway) independently holds a separate MA-M block under the distinct organization name "Zivid AS" — coincidental name overlap, not affiliated [Confirmed] — the IEEE MA-M registry 4C4BF98. WISEWARE, Lda (Portugal) is a second false-positive: "ZIV" appears only inside its registered-address place-name, not as an organization name

[Confirmed] — the IEEE MA-L registry 54FB58

Analyst note

only the 3 MA-L blocks under the exact organization name "ZIV" belong to this vendor — do not fold in Zivid AS's MA-M block or any address-text substring match; organization-name identity, not string match, defines this entry [Confirmed] — the IEEE MA-L registry; the IEEE MA-M registry