CISA + Hersteller
ICS-Advisories
Advisories speziell für industrielle Steuerungssysteme — von CISA ICS-CERT und direkt von Herstellern (darunter Siemens, ABB, Schneider Electric, WAGO und Phoenix Contact) — einschließlich Revisionshistorie (Erstveröffentlichung, Update A, Update B) und verknüpfter CVEs.
1
Gefunden
Advisory-Daten: Live-Anbindung— zuletzt abgerufen: 7. November 2026 um 15:23.
Filter
1 aktiv1 Advisories gefunden
VDE-2024-049
Beckhoff: Denial-of-Service vulnerability in the IPC-Diagnostics package included in TwinCAT/BSD operating system
Veröffentlicht
27. August 2024
Letzte Aktualisierung
22. Mai 2025
Verknüpfte CVEs
Betroffene Sektoren
Risk Evaluation
By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then lets the process 'MDPWebServer' consume a maximum of CPU cycles and Random Access Memory (RAM).
Zusammenfassung der Gegenmaßnahmen
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.
Revisionshistorie (4)
Erstveröffentlichung — 13. August 2024
initial revision
Update A — 6. November 2024
Fix: correct certvde domain, added self-reference
Update B — 16. Januar 2025
Fix: list of branches, references url
Update C — 11. April 2025
Fix: version range