Industrial Control Systems (ICSs) are critical components of a country’s information infrastructure, and their security is essential for national security. Recent attack incidents have highlighted that ICS protocols represent a significant attack surface. Vulnerabilities in these protocols can be proactively identified through fuzz testing techniques. Current protocol fuzz testing technologies primarily aim to enhance code coverage through techniques like protocol reverse engineering and state machine inference. For ICS protocols, test data is often generated by randomly mutating protocol fields, leading to a significant amount of test data that do not adhere to protocol specifications. Furthermore, existing testing methods rely solely on code branches and protocol states to guide the fuzzing process, without utilizing fine-grained execution path information, such as the depth, the danger of a function, etc. This limitation results in blind mutation and lowers fuzzing efficiency. To solve these challenges, this paper proposes an enhanced fuzzing method – ICSPFuzzer. By leveraging the structural and functional characteristics of ICS protocols – such as identifier, function code, program path depth and dangerous operation mappings, ICSPFuzzer improves seed mutation strategies and optimizes power scheduling for more efficient fuzz testing. We evaluated ICSPFuzzer on three widely used ICS protocols –Modbus, IEC61850, and IEC104. Compared to AFL, ICSPFuzzer achieved an average increase of 11.97% in path coverage and a 74.08% improvement in detected crashes. In addition, ICSPFuzzer uncovered three 0-day vulnerabilities in IEC61850, two of which are classified as high-risk. The test results demonstrate that the tool is both efficient and practical.