CISA + Hersteller
ICS-Advisories
Advisories speziell für industrielle Steuerungssysteme — von CISA ICS-CERT und direkt von Herstellern (darunter Siemens, ABB, Schneider Electric, WAGO und Phoenix Contact) — einschließlich Revisionshistorie (Erstveröffentlichung, Update A, Update B) und verknüpfter CVEs.
1
Gefunden
Advisory-Daten: Live-Anbindung— zuletzt abgerufen: 7. November 2026 um 15:23.
Filter
1 aktiv1 Advisories gefunden
VDE-2021-051
Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server
Veröffentlicht
4. November 2021
Letzte Aktualisierung
22. Mai 2025
Verknüpfte CVEs
Betroffene Sektoren
Risk Evaluation
Through specific nodes of the server configuration interface of the TwinCAT OPC UA Server administrators are able to remotely create and delete any files on the system which the server is running on, though this access should have been restricted to specific directories. In case that configuration interface is combined with not recommended settings to allow anonymous access via the TwinCAT OPC UA Server then this kind of file access is even possible for any unauthenticated user from remote.
Zusammenfassung der Gegenmaßnahmen
Consider restricting access to the nodes of the 'TcOpcUAServer' with the methods described by https://infosys.beckhoff.com/content/1033/tcopcuaserver/5930038411-1.html such that the administrative interface can only be accessed by administrative users of well known OPC UA clients.
Revisionshistorie (2)
Erstveröffentlichung — 4. November 2021
initial revision
Update A — 22. Mai 2025
Fix: added distribution, quotation mark