CISA + leveranciers
ICS Advisories
Advisories specifiek gericht op industriële besturingssystemen — van CISA ICS-CERT en rechtstreeks van leveranciers (onder meer Siemens, ABB, Schneider Electric, WAGO en Phoenix Contact) — inclusief revisiegeschiedenis (initiële publicatie, Update A, Update B) en gekoppelde CVE's.
1
Gevonden
Advisorydata: live koppeling— laatst opgehaald: 7 november 2026 om 14:22.
Filters
1 actief1 advisories gevonden
VDE-2024-045
Beckhoff: Local authentication bypass in IPC-Diagnostics package included in TwinCAT/BSD operating system
Gepubliceerd
27 augustus 2024
Laatste update
22 mei 2025
Gekoppelde CVE's
Getroffen sectoren
Risk evaluation
By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, the authentication mechanism for the web interface can be bypassed by any local user, regardless of their permissions, and they can act with administrative access rights via this mechanism.
Mitigatiesamenvatting
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.
Revisiegeschiedenis (4)
Initiële publicatie — 13 augustus 2024
initial revision
Update A — 6 november 2024
Fix: correct certvde domain, added self-reference
Update B — 16 januari 2025
Fix: list of branches, references url
Update C — 11 april 2025
Fix: version range