Vulnerabilidades de Beckhoff Automation
CVEs publicadas que afetam produtos de Beckhoff Automation: 4 registro(s), com severidade, exploração e correções.
Beckhoff.Device.Manager.XAR 3MDP software package for TwinCAT/BSD 3MDP for Beckhoff RT Linux(R) 3TwinCAT.HMI.Server 1TF2000-HMI-Server 1
CVE-2025-41728
Média · 5.3
CWE-125 27/01/2026
Beckhoff: Information leak via Beckhoff Device Manager
A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially copy confidential information into a response.
CVE-2025-41727
Alta · 7.8
CWE-420 27/01/2026
Beckhoff: Performing privileged operations and gaining administrator access
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.
CVE-2025-41726
Alta · 8.8
CWE-190 27/01/2026
Beckhoff: Arbitrary code execution within privileged processes
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
CVE-2025-41768
Média · 5.5
CWE-79 20/01/2026
Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').