Beckhoff Automation vulnerabilities
Published CVEs affecting Beckhoff Automation products: 4 record(s), with severity, exploitation and fixes.
Beckhoff.Device.Manager.XAR 3MDP software package for TwinCAT/BSD 3MDP for Beckhoff RT Linux(R) 3TwinCAT.HMI.Server 1TF2000-HMI-Server 1
CVE-2025-41728
Medium · 5.3
CWE-125 Jan 27, 2026
Beckhoff: Information leak via Beckhoff Device Manager
A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially copy confidential information into a response.
CVE-2025-41727
High · 7.8
CWE-420 Jan 27, 2026
Beckhoff: Performing privileged operations and gaining administrator access
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.
CVE-2025-41726
High · 8.8
CWE-190 Jan 27, 2026
Beckhoff: Arbitrary code execution within privileged processes
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
CVE-2025-41768
Medium · 5.5
CWE-79 Jan 20, 2026
Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').