CVE-2024-8934

mediumpriority · track · 0EPSS 0.002 · 8 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.19% (8th) EPSS
CVSS 6.5 · medium
Is it mine?
9 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · beckhoff_psirt

EPSS · scored 2026-10-27

A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedTwinCAT Package Managerbeckhoff_psirt

    Please update TwinCAT Package Manager to 1.0.603.0

  • MitigationTwinCAT Package Managerbeckhoff_psirt

    Administrative users shall always act thoroughly and inspect the values which they enter.

  • MitigationTwinCAT Package Managercisa_csaf_ot

    Additionally, Beckhoff Automation has identified the following specific workarounds and mitigations users can apply to reduce risk:

02

cvss

Technical severity, 0–10. One row per scoring source.

6.5
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.16.5mediumAV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 0.6 · impact 5.9
v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:Hsecondary · Beckhoff PSIRT DE
v3.16mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USCWE-78USCWE-78USCWE-78US
05

affected products (9)

Products and version ranges known to be affected.

06

advisories (2)

Vendor and ecosystem advisories describing this.

  • VDE-2024-064Beckhoff: Local command injection via TwinCAT Package Manager2024-10-31csaf · beckhoff_psirtDE

    Beckhoff's TwinCAT 3.1 Build 4026 software is modularized and is installed with different packages depending on user requirements. These packages are selected and installed using either the command line utility tcpkg or the corresponding graphical user interface called TwinCAT Package Manager. Both use the same configuration that specifies where to load packages from. These locations are called feeds, have preconfigured default settings and can be customized by administrative users, for example to add another local mirror of a package server. When using the TwinCAT Package Manager on a PC, a user with administrative access rights can locally set a specially crafted URL for a feed that causes the TwinCAT Package Manager to execute arbitrary operating system commands.

  • ICSA-24-312-01Beckhoff Automation TwinCAT Package Manager2024-11-07icsa · cisa_csaf_otUS

    Successful exploitation this vulnerability could allow a local attacker with administrative access rights to execute arbitrary OS commands on the affected system.

07

also known as (5)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bdubeckhoff_psirtcisa_csaf_otNVDCVE.orgMITRE
published 2024-10-31modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan