Most recent entries from csaf_beckhoffautomationgmbhcokg

VDE-2025-106 — Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

Mon, 26 Jan 2026 10:00:00 +0000

An optional package of the TwinCAT 3 XAR installs the TwinCAT 3 HMI Server on a device. It provides a server configuration page which can be accessed by administrative users only. When such an administrator accesses the server configuration page it is possible to upload arbitrary content into the CUSTOM_CSS field which is then persisted on the device and later returned and rendered with each login and error page. Please note that administrators have the access rights to modify any content on the HMI server, for example, via the server configuration page. Therefore, administrators would have to act maliciously to exploit this vulnerability.

VDE-2025-092 — Beckhoff: Privilege escalation and information leak via Beckhoff Device Manager

Tue, 27 Jan 2026 11:00:00 +0000

The vulnerability CVE-2025-41726 (NN-2025-0074) allows an authenticated remote user to execute arbitrary commands on the device. This can be exploited over the web UI or via API. In one case the execution of the arbitrary command happens within a privileged process.

The vulnerability CVE-2025-41727 (NN-2025-0075) allows a local user with low privileges on the device to bypass the authentication mechanism of the UI and send commands to a privileged process which it executes on behalf of that user but with higher privileges. This way the local user can escalate privileges.

The vulnerability CVE-2025-41728 (NN-2025-0076) allows an authenticated remote user to cause an out-of-bounds read operation within a specific service process which runs on the device. The read operation might copy sensitive information from the memory of the specific service into a response message which is then provided to the user but the user cannot choose which information is disclosed.

VDE-2025-075 — Beckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering

Tue, 09 Sep 2025 10:00:00 +0000

Beckhoff's TwinCAT 3 Engineering software is intented to craft automation projects consisting of a set of files which are stored locally as files underneath an individual folder or in a packed file. The TwinCAT 3 Engineering stores user settings and preferences among the non packed local files which are relevant to continue former work on the project conventienly. TwinCAT 3 Engineering stores such settings in files which are called "Solution User Options (.suo) File". When such settings are manipulated or crafted by an adversary in a specific way then TwinCAT 3 Engineering executes arbitrary commands as determined by these settings when the user uses TwinCAT 3 Engineering to open the project. These arbitrary commands are executed in the user context.

Please note that solution user option files should not be checked in to source code control. This is also a best practice when working with source code projects and solutions. For example, see https://learn.microsoft.com/en-us/visualstudio/extensibility/internals/solution-user-options-dot-suo-file and https://infosys.beckhoff.com/content/1033/tc3_sourcecontrol/14604066827.html.

The vulnerability is similar to older vulnerabilities that were addressed in the CODESYS Development System V3 product from CODESYS GmbH with CVE-2021-21864, CVE-2021-21865, CVE-2021-21866, CVE-2021-21867, CVE-2021-21868, CVE-2021-21869, and the associated Advisory 2021-13 from CODESYS GmbH.

VDE-2022-003 — BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology

Tue, 01 Mar 2022 12:34:00 +0000

By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.

VDE-2024-050 — Beckhoff: Denial-of-Service vulnerability in the MDP package included in TwinCAT/BSD operating system

Tue, 27 Aug 2024 08:00:00 +0000

The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local attacker to induce a Denial-of-Service (DoS) condition on the daemon and execute code in the context of user 'root' via a crafted HTTP request.

VDE-2024-049 — Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system

Tue, 27 Aug 2024 08:00:00 +0000

The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker.

VDE-2024-048 — Beckhoff: Improper neutralization of input in IPC-Diagnostics-www package included in TwinCAT/BSD operating system

Tue, 27 Aug 2024 08:00:00 +0000

The IPC-Diagnostics-www package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker.

VDE-2024-045 — Beckhoff: Local authentication bypass in IPC-Diagnostics package included in TwinCAT/BSD operating system

Tue, 27 Aug 2024 08:00:00 +0000

The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.

VDE-2023-067 — Beckhoff: Open redirect in TwinCAT/BSD package authelia-bhf

Wed, 13 Dec 2023 08:00:00 +0000

The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect anthelia-bhf the Beckhoff fork of authelia.

VDE-2021-051 — Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server

Thu, 04 Nov 2021 07:00:00 +0000

TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.