Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system
By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then lets the process 'MDPWebServer' consume a maximum of CPU cycles and Random Access Memory (RAM).
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-41175US | — | — | ||
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2024-049: Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system - CSAFself
- VDE-2024-049: Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system - HTMLself
- CERT@VDE Security Advisories for Beckhoff Automation GmbH & Co. KGexternal
- Beckhoff Security Advisory 2024-003: Local Denial of Service issue in TwinCAT/BSD package 'IPC-Diagnostics' - PDF versionself
- Detailed information on updating the TwinCAT/BSD operating systemexternal
- Additional information about the latest IPC security advisories is provided here:external
Behebungen (2)
- Mitigation
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.
- Behoben
Please update to a recent version of the affected product.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan