ICS-Advisories

Risk Evaluation

An optional package of the TwinCAT 3 XAR installs the TwinCAT 3 HMI Server on a device. It provides a server configuration page which can be accessed by administrative users only. When such an administrator accesses the server configuration page it is possible to upload arbitrary content into the CUSTOM_CSS field which is then persisted on the device and later returned and rendered with each login and error page. Please note that administrators have the access rights to modify any content on the HMI server, for example, via the server configuration page. Therefore, administrators would have to act maliciously to exploit this vulnerability.

Zusammenfassung der Gegenmaßnahmen

Please update to a recent version of the affected components.

Risk Evaluation

The vulnerability CVE-2025-41726 (NN-2025-0074) allows an authenticated remote user to execute arbitrary commands on the device. This can be exploited over the web UI or via API. In one case the execution of the arbitrary command happens within a privileged process. The vulnerability CVE-2025-41727 (NN-2025-0075) allows a local user with low privileges on the device to bypass the authentication mechanism of the UI and send commands to a privileged process which it executes on behalf of that user but with higher privileges. This way the local user can escalate privileges. The vulnerability CVE-2025-41728 (NN-2025-0076) allows an authenticated remote user to cause an out-of-bounds read operation within a specific service process which runs on the device. The read operation might copy sensitive information from the memory of the specific service into a response message which is then provided to the user but the user cannot choose which information is disclosed.

Zusammenfassung der Gegenmaßnahmen

Please update to a recent version of the affected components or update the complete operating system image. Operating system images are available on request from Beckhoff's service (service@beckhoff.com). The setup / installer for Windows 10 and 11 are available on request from Beckhoff's service also.

Risk Evaluation

Beckhoff's TwinCAT 3 Engineering software is intented to craft automation projects consisting of a set of files which are stored locally as files underneath an individual folder or in a packed file. The TwinCAT 3 Engineering stores user settings and preferences among the non packed local files which are relevant to continue former work on the project conventienly. TwinCAT 3 Engineering stores such settings in files which are called "Solution User Options (.suo) File". When such settings are manipulated or crafted by an adversary in a specific way then TwinCAT 3 Engineering executes arbitrary commands as determined by these settings when the user uses TwinCAT 3 Engineering to open the project. These arbitrary commands are executed in the user context. Please note that solution user option files should not be checked in to source code control. This is also a best practice when working with source code projects and solutions. For example, see https://learn.microsoft.com/en-us/visualstudio/extensibility/internals/solution-user-options-dot-suo-file and https://infosys.beckhoff.com/content/1033/tc3_sourcecontrol/14604066827.html. The vulnerability is similar to older vulnerabilities that were addressed in the CODESYS Development System V3 product from CODESYS GmbH with CVE-2021-21864, CVE-2021-21865, CVE-2021-21866, CVE-2021-21867, CVE-2021-21868, CVE-2021-21869, and the associated Advisory 2021-13 from CODESYS GmbH.

Zusammenfassung der Gegenmaßnahmen

Please update to a recent version of the affected product and uninstall older versions of TwinCAT 3 Engineering. Make sure that older versions of TwinCAT 3 Engineering do not occur as "Remote Manager" versions, see https://infosys.beckhoff.com/content/1033/tc3_remote_manager/index.html?id=1584127271344589360. Remove the "pinning" from your projects to older versions of TwinCAT 3 Engineering, if present, see https://infosys.beckhoff.com/content/1033/tc3_remote_manager/3154642571.html.

Risk Evaluation

By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.

Zusammenfassung der Gegenmaßnahmen

Have your applications configured to use other than SecurityMode=None for all OPC UA connections. Avoid that these connect to an unknown OPC UA server with SecurityMode=None. In particular, avoid that your applications connect to servers which they discover via mDNS, a Local Discovery Server (LDS), an untrusted Global Discovery Server (GDS) or even trusted GDS using SecurityMode=none. Especially in the latter case an adversary might be able to apply the 'man in the middle' pattern to attack the connection and inject a bad message which triggers the vulnerability.

Risk Evaluation

Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames.

Zusammenfassung der Gegenmaßnahmen

Beckhoff offers software patches for TwinCAT 3.1 and TwinCAT 2.11 on request. These patches will be included in the the next regular releases to the affected software versions. The advisory will be updated upon availability.

Risk Evaluation

The affected products can act as OPC UA client or server and are vulnerable to two different kind of attacks via the OPC UA protocol. For both cases the attacker can send packets via the OPC UA protocol without the need to authenticate and 1. provoke a stack overflow resulting in denial of service of the product or 2. make the product disclose information to the attacker without authorization.

Zusammenfassung der Gegenmaßnahmen

Consider limiting access to the network communication ports of affected server products. Also consider limiting where the affected client products are allowed to connect to. For example, this can be achived with Windows' built-in firewall by incoming rules for servers and outgoing rules for clients. Consider to minimize the ability of an attacker to hijack communication establishment from a client to a server. For example this can be achieved with the help of zones and conduits: Try to keep servers and clients within the same network zone and prevent intrusion into that zone. Try to enclose communication establishment within conduits like VPN channels (where one conduit can serve for many OPC UA connections) and prevent attackers from intruding into such channels. Consider updating the .NET Framework.

Risk Evaluation

The default installation path and its permissions for the TwinCAT runtime allow a local user to replace or modify executables other users of the same system might execute. The issue does not apply for installations underneath C:\Program Files.

Zusammenfassung der Gegenmaßnahmen

Please consider the solution described with the next section (title 'Solution') for new installations only and installations for which it is acceptable to reinstall TwinCAT. For existing installations a script is provided for download at the following link: https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2020-003/cve-2020-12510.zip external link It changes the permissions of a directory of an already installed TwinCAT 3.1 installation. More precisely, it reads the current permissions of 'C:\Program Files' and copies them to the directory '3.1\System' underneath the installation path of TwinCAT (default 'C:\TwinCAT\3.1\System'). The procedure to use that script is as follows: 1. Download the script, unzip it, and copy it to the IPC. 2. On the IPC log in as administrator and open a PowerShell (Windows-Key + R + 'PowerShell'). 3. At the PowerShell enter the following command to temporarily allow the execution of scripts: set-executionpolicy -ExecutionPolicy Unrestricted -Scope Process (The effect of this is limited to the life-time of the current shell window because of '-Scope Process'.) 4. Then change to the path to where you downloaded the script and execute it: .\cve-2020-12510.ps1 The expected output is 'Copied the permissions from C:\Program Files to \3.1\System'. 5. Close the PowerShell and log out from the IPC as needed. It is safe to apply the script several times. It is safe to run it during full operation of TwinCAT XAR 3.1. There is no need to reboot the IPC afterwards. There is no need to periodically run the script. Future updates of TwinCAT 3.1 will either not touch the permissions which are set by the script or apply more appropriate ones. To apply the procedure to a set of IPCs you can prepare a USB stick with the content of the ZIP file 'cve-2020- 12510.zip' (see download URL above). Then the procedure for each IPC is: 1. Log in as administrator on the IPC. 2. Open the USB stick with the File Explorer (formerly known as Windows Explorer). 3. Double click on the file 'run-cve-2020-12510.bat'. (This simply invokes the PowerShell to execute the script already described above.)

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, the user can bypass input validation by entering specially crafted inputs into the user interface for certain pages, which then allows local commands to be executed with administrative privileges.

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

Through specific nodes of the server configuration interface of the TwinCAT OPC UA Server administrators are able to remotely create and delete any files on the system which the server is running on, though this access should have been restricted to specific directories. In case that configuration interface is combined with not recommended settings to allow anonymous access via the TwinCAT OPC UA Server then this kind of file access is even possible for any unauthenticated user from remote.

Zusammenfassung der Gegenmaßnahmen

Consider restricting access to the nodes of the 'TcOpcUAServer' with the methods described by https://infosys.beckhoff.com/content/1033/tcopcuaserver/5930038411-1.html such that the administrative interface can only be accessed by administrative users of well known OPC UA clients.

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then causes a buffer overflow on stack which in turn lets the process 'MDPService' crash such that the web interface becomes unavailable until next restart or even execute code in the context of user 'root'.

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

The coupler's function could be inhibited by an attack.

Zusammenfassung der Gegenmaßnahmen

Beckhoff will not change this behaviour. Customers should configure a perimeter firewall to block traffic from untrusted networks to the device.

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, the authentication mechanism for the web interface can be bypassed by any local user, regardless of their permissions, and they can act with administrative access rights via this mechanism.

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

With TwinCAT/BSD based products the HTTPS request to the Authelia login page accepts user-controlled input that specifies a link to an external site.

Zusammenfassung der Gegenmaßnahmen

Use firewall or web-proxy technology at your network perimeter which allow internal clients to access only trusted external sites directly.

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then lets the process 'MDPWebServer' consume a maximum of CPU cycles and Random Access Memory (RAM).

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

In case TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending special packets to the device.

Zusammenfassung der Gegenmaßnahmen

Profinet could be blocked in perimeter firewall to block PROFINET DCP packets from untrusted networks to the device. Beckhoff will provide updates for the mentioned TwinCAT Versions.

Risk Evaluation

Beckhoff's TwinCAT 3.1 Build 4026 software is modularized and is installed with different packages depending on user requirements. These packages are selected and installed using either the command line utility tcpkg or the corresponding graphical user interface called TwinCAT Package Manager. Both use the same configuration that specifies where to load packages from. These locations are called feeds, have preconfigured default settings and can be customized by administrative users, for example to add another local mirror of a package server. When using the TwinCAT Package Manager on a PC, a user with administrative access rights can locally set a specially crafted URL for a feed that causes the TwinCAT Package Manager to execute arbitrary operating system commands.

Zusammenfassung der Gegenmaßnahmen

Administrative users shall always act thoroughly and inspect the values which they enter.

Risk Evaluation

Some TwinCAT OPC UA Server and IPC Diagnostics UA Server versions from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to the running OPC UA server. After some of these requests the OPC UA server is no longer responsive to any client. This is without effect to the real-time functionality of IPCs. UPDATE A - 11.05.2021 Please note that some hardware products from Beckhoff are shipped with a TwinCAT OPC UA Server pre-installed. In some cases the server is enabled by default. IPC Diagnostics UA Server (contained in Beckhoff's Windows images) server versions up to and including 3.1.0.1 are affected Please note that IPC products from Beckhoff are shipped with an IPC Diagnostics UA Server pre-installed. In all cases the server is disabled by default. The version numbers named above always refer to the version number which is accessible via OPC UA at the server via the standard OPC UA node /Objects/Server/ServerStatus/BuildInfo/SoftwareVersion and on Windows also as the file property "File version" of the file TcOpcUaServer.exe for TwinCAT OPC UA Server respectively the file DevMgrSvr-UA.exe for IPC Diagnostics UA Server. UPDATE A - 11.05.2021 Please note that IPC products from Beckhoff are shipped with an IPC Diagnostics UA Server pre-installed. While on Windows CE it is disabled by default all other Windows images have it enabled by default.

Zusammenfassung der Gegenmaßnahmen

Consider disabling the IPC Diagnostics Server by stopping and disabling the corresponding Windows service or service. For example this can be achieved with the following PowerShell commands: Stop-Service -Force -Name DevMgrSvr-UA Set-Service -Name DevMgrSvr-UA -StartupType Disabled Alternatively consider limiting access to the TCP port the OPC UA server is listening on. This can happen with a dedicated firewall appliance which sits in front of an affected device. Alternatively at the device the Windows firewall can be configured to limit access to the TCP port. Further guidance is provided within the "Security Guide IPC" from Beckhoff which is accessible at https://www.beckhoff.com/secguide