CVE-2025-41727

highpriority · track · 0EPSS 0.002 · 7 %ileDEEU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.18% (7th) EPSS

CVSS 7.8 · high

Is it mine?

15 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · beckhoff_psirt

EPSS · scored 2026-10-27

A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedbeckhoff_psirt
Please update to a recent version of the affected components or update the complete operating system image. Operating system images are available on request from Beckhoff's service (service@beckhoff.com). The setup / installer for Windows 10 and 11 are available on request from Beckhoff's service also.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Beckhoff PSIRT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-420USCWE-420US

affected products (15)

Products and version ranges known to be affected.

Beckhoff IPC Diagnostics software for Windows 2.5.3all versionsfixedbeckhoff_psirtDEcpe:2.3:a:beckhoff:ipc_diagnostics_package:2.5.3:*:*:*:*:Windows:*:*
Beckhoff IPC Diagnostics softwarefor Windows 2.4.5all versionsbeckhoff_psirtDEcpe:2.3:a:beckhoff:ipc_diagnostics_package:2.4.5:*:*:*:*:Windows:*:*
Beckhoff.Device.Manager.XAR tcpkg package 2.5.3all versionsfixedbeckhoff_psirtDEpkg:tcpkg/beckhoff/Beckhoff.Device.Manager.XAR@2.5.3
Beckhoff.Device.Manager.XAR tcpkg package <2.5.3≤ vers:semver/<2.5.3beckhoff_psirtDEpkg:tcpkg/beckhoff/Beckhoff.Device.Manager.XAR?vers=%3C2.5.3
MDP software package for TwinCAT/BSD 1.7.0.0all versionsfixedbeckhoff_psirtDEpkg:bsd/beckhoff/MDP@1.7.0.0
MDP software package for TwinCAT/BSD <1.7.0.0≤ vers:generic/<1.7.0.0beckhoff_psirtDEpkg:bsd/beckhoff/MDP?vers=%3C1.7.0.0
MDP.dll library library for Windows CE 6.0 and Embedded Compact 7 on ARM32 1.7.0.0all versionsfixedbeckhoff_psirtDEcpe:2.3:a:beckhoff:MDP.dll:1.7.0.0:*:*:*:*:*:arm32:*
MDP.dll library library for Windows CE 6.0 and Embedded Compact 7 on x86 1.7.0.0all versionsfixedbeckhoff_psirtDEcpe:2.3:a:beckhoff:MDP.dll:1.7.0.0:*:*:*:*:*:x86:*
MDP.dll library library for Windows CE 6.0 and Embedded Compact on ARM32 7 1.2.4.0all versionsbeckhoff_psirtDEcpe:2.3:a:beckhoff:MDP.dll:1.2.4.0:*:*:*:*:*:arm32:*
MDP.dll library library for Windows CE 6.0 and Embedded Compact on x86 7 1.2.4.0all versionsbeckhoff_psirtDEcpe:2.3:a:beckhoff:MDP.dll:1.2.4.0:*:*:*:*:*:x86:*
mdp-bhf software package Beckhoff RT Linux(R) 0.0.5-1all versionsfixedbeckhoff_psirtDEpkg:deb/beckhoff/mdp-bhf@0.0.5-1
mdp-bhf software package Beckhoff RT Linux(R) <0.0.5-1≤ vers:generic/<0.0.5-1beckhoff_psirtDEpkg:deb/beckhoff/mdp-bhf?vers=%3C0.0.5-1
Beckhoff Automation Beckhoff.Device.Manager.XAR0.0.0 → 2.5.3enisa_euvdEU
Beckhoff Automation MDP for Beckhoff RT Linux(R)0.0.0 → 0.0.5enisa_euvdEU
Beckhoff Automation MDP software package for TwinCAT/BSD0.0.0 → 1.7.0.0enisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2025-092Beckhoff: Privilege escalation and information leak via Beckhoff Device Manager2026-01-27csaf · beckhoff_psirtDE
The vulnerability CVE-2025-41726 (NN-2025-0074) allows an authenticated remote user to execute arbitrary commands on the device. This can be exploited over the web UI or via API. In one case the execution of the arbitrary command happens within a privileged process. The vulnerability CVE-2025-41727 (NN-2025-0075) allows a local user with low privileges on the device to bypass the authentication mechanism of the UI and send commands to a privileged process which it executes on behalf of that user but with higher privileges. This way the local user can escalate privileges. The vulnerability CVE-2025-41728 (NN-2025-0076) allows an authenticated remote user to cause an out-of-bounds read operation within a specific service process which runs on the device. The read operation might copy sensitive information from the memory of the specific service into a response message which is then provided to the user but the user cannot choose which information is disclosed.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd beckhoff_psirt NVD CVE.org MITRE

published 2026-01-27modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan