CVE-2024-41176

highpriority · track · 0EPSS 0.003 · 18 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.27% (18th) EPSS
CVSS 7.3 · high
Is it mine?
14 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · beckhoff_psirt

EPSS · scored 2026-10-27

The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local attacker to induce a Denial-of-Service (DoS) condition on the daemon and execute code in the context of user “root” via a crafted HTTP request.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedbeckhoff_psirt

    Please update to a recent version of the affected product.

  • Mitigationbeckhoff_psirt

    Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.3

v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · NVD / NIST USexploitability 1.8 · impact 5.5
v3.16.5mediumAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · ENISA EU
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · info@cert.vde.comexploitability 1.8 · impact 5.5
v3.16.5mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · Beckhoff PSIRT DE
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-120USCWE-120USCWE-121USCWE-121US
05

affected products (14)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2024-050Beckhoff: Denial-of-Service vulnerability in the MDP package included in TwinCAT/BSD operating system2024-08-27csaf · beckhoff_psirtDE

    By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then causes a buffer overflow on stack which in turn lets the process 'MDPService' crash such that the web interface becomes unavailable until next restart or even execute code in the context of user 'root'.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bdubeckhoff_psirtnvdNVDCVE.orgMITRE
published 2024-08-27modified 2026-06-17
09

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan