CISA + leveranciers
ICS Advisories
Advisories specifiek gericht op industriële besturingssystemen — van CISA ICS-CERT en rechtstreeks van leveranciers (onder meer Siemens, ABB, Schneider Electric, WAGO en Phoenix Contact) — inclusief revisiegeschiedenis (initiële publicatie, Update A, Update B) en gekoppelde CVE's.
1
Gevonden
Advisorydata: live koppeling— laatst opgehaald: 7 november 2026 om 14:22.
Filters
1 actief1 advisories gevonden
VDE-2021-051
Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server
Gepubliceerd
4 november 2021
Laatste update
22 mei 2025
Gekoppelde CVE's
Getroffen sectoren
Risk evaluation
Through specific nodes of the server configuration interface of the TwinCAT OPC UA Server administrators are able to remotely create and delete any files on the system which the server is running on, though this access should have been restricted to specific directories. In case that configuration interface is combined with not recommended settings to allow anonymous access via the TwinCAT OPC UA Server then this kind of file access is even possible for any unauthenticated user from remote.
Mitigatiesamenvatting
Consider restricting access to the nodes of the 'TcOpcUAServer' with the methods described by https://infosys.beckhoff.com/content/1033/tcopcuaserver/5930038411-1.html such that the administrative interface can only be accessed by administrative users of well known OPC UA clients.
Revisiegeschiedenis (2)
Initiële publicatie — 4 november 2021
initial revision
Update A — 22 mei 2025
Fix: added distribution, quotation mark