CISA + Hersteller
ICS-Advisories
Advisories speziell für industrielle Steuerungssysteme — von CISA ICS-CERT und direkt von Herstellern (darunter Siemens, ABB, Schneider Electric, WAGO und Phoenix Contact) — einschließlich Revisionshistorie (Erstveröffentlichung, Update A, Update B) und verknüpfter CVEs.
1
Gefunden
Advisory-Daten: Live-Anbindung— zuletzt abgerufen: 7. November 2026 um 15:23.
Filter
1 aktiv1 Advisories gefunden
VDE-2024-064
Beckhoff: Local command injection via TwinCAT Package Manager
Veröffentlicht
31. Oktober 2024
Letzte Aktualisierung
11. April 2025
Verknüpfte CVEs
Betroffene Sektoren
Risk Evaluation
Beckhoff's TwinCAT 3.1 Build 4026 software is modularized and is installed with different packages depending on user requirements. These packages are selected and installed using either the command line utility tcpkg or the corresponding graphical user interface called TwinCAT Package Manager. Both use the same configuration that specifies where to load packages from. These locations are called feeds, have preconfigured default settings and can be customized by administrative users, for example to add another local mirror of a package server. When using the TwinCAT Package Manager on a PC, a user with administrative access rights can locally set a specially crafted URL for a feed that causes the TwinCAT Package Manager to execute arbitrary operating system commands.
Zusammenfassung der Gegenmaßnahmen
Administrative users shall always act thoroughly and inspect the values which they enter.
Revisionshistorie (3)
Erstveröffentlichung — 31. Oktober 2024
initial revision
Update A — 16. Januar 2025
Fix: list of branches, references
Update B — 11. April 2025
Fix: version range