Beckhoff PSIRT
organizationDE01
references
Other names and identifiers for this entity.
beckhoff_psirtDE product-securityincident@beckhoff.com
02
assessed vulnerabilities (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41728US | — | — | ||
A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager w… | ||||
| CVE-2025-41727US | — | — | ||
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access. | ||||
| CVE-2025-41726US | — | — | ||
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer… | ||||
| CVE-2025-41768US | — | — | ||
An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation… | ||||
| CVE-2025-41701US | — | — | ||
An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arb… | ||||
| CVE-2024-8934US | — | — | ||
A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary… | ||||
| CVE-2024-41176US | — | — | ||
The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local
attacker to induce a Denial-of-Service (DoS) condition on the daemon and execute code in
the c… | ||||
| CVE-2024-41175US | — | — | ||
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker. | ||||
| CVE-2024-41174US | high7.3 | — | ||
The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker. | ||||
| CVE-2024-41173US | —OT elevated | — | ||
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker. | ||||
| CVE-2023-6545US | — | — | ||
The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have… | ||||
| CVE-2021-45117US | medium6.5 | — | ||
The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference. | ||||
| CVE-2021-34594US | medium6.5 | — | ||
TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow admi… | ||||
| CVE-2021-27432US | high7.5 | — | ||
OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may allow an attacker to trigger a stack over… | ||||
| CVE-2021-27434US | high7.5 | — | ||
Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vulnerable to an uncontr… | ||||
| CVE-2020-12526US | medium5.3 | — | ||
TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service… | ||||
| CVE-2020-12510US | high7.3OT elevated | — | ||
The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created wi… | ||||
| CVE-2020-12494US | medium5.0 | — | ||
Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from r… | ||||
| CVE-2020-9464US | high7.5 | — | ||
A Denial-of-Service vulnerability exists in BECKHOFF Ethernet TCP/IP Bus Coupler BK9000. After an attack has occurred, the device's functionality can be restored by rebooting. | ||||
| CVE-2019-5637US | high7.5 | — | ||
When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue a… | ||||