CISA + vendors
ICS Advisories
Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.
1
Found
Advisory data: live connection— last retrieved: 7 November 2026 at 15:23.
Filters
1 active1 advisories found
VDE-2024-050
Beckhoff: Denial-of-Service vulnerability in the MDP package included in TwinCAT/BSD operating system
Risk evaluation
By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then causes a buffer overflow on stack which in turn lets the process 'MDPService' crash such that the web interface becomes unavailable until next restart or even execute code in the context of user 'root'.
Mitigation summary
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.
Revision history (4)
Initial publication — 13 August 2024
initial revision
Update A — 6 November 2024
Fix: correct certvde domain, added self-reference
Update B — 16 January 2025
Fix: list of branches, typo in reference url
Update C — 11 April 2025
Fix: version range