Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system
By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then lets the process 'MDPWebServer' consume a maximum of CPU cycles and Random Access Memory (RAM).
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-41175US | — | — | ||
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker. | ||||
references
External citations — patches, advisories, analysis.
- VDE-2024-049: Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system - CSAFself
- VDE-2024-049: Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system - HTMLself
- CERT@VDE Security Advisories for Beckhoff Automation GmbH & Co. KGexternal
- Beckhoff Security Advisory 2024-003: Local Denial of Service issue in TwinCAT/BSD package 'IPC-Diagnostics' - PDF versionself
- Detailed information on updating the TwinCAT/BSD operating systemexternal
- Additional information about the latest IPC security advisories is provided here:external
remediations (2)
- Mitigation
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.
- Fixed
Please update to a recent version of the affected product.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan