CISA + leveranciers
ICS Advisories
Advisories specifiek gericht op industriële besturingssystemen — van CISA ICS-CERT en rechtstreeks van leveranciers (onder meer Siemens, ABB, Schneider Electric, WAGO en Phoenix Contact) — inclusief revisiegeschiedenis (initiële publicatie, Update A, Update B) en gekoppelde CVE's.
1
Gevonden
Advisorydata: live koppeling— laatst opgehaald: 7 november 2026 om 14:22.
Filters
1 actief1 advisories gevonden
VDE-2024-048
Beckhoff: Improper neutralization of input in IPC-Diagnostics-www package included in TwinCAT/BSD operating system
Gepubliceerd
27 augustus 2024
Laatste update
22 mei 2025
Gekoppelde CVE's
Getroffen sectoren
Risk evaluation
By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, the user can bypass input validation by entering specially crafted inputs into the user interface for certain pages, which then allows local commands to be executed with administrative privileges.
Mitigatiesamenvatting
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.
Revisiegeschiedenis (4)
Initiële publicatie — 13 augustus 2024
initial revision
Update A — 6 november 2024
Fix: correct certvde domain, added self-reference
Update B — 16 januari 2025
Fix: list of branches
Update C — 11 april 2025
Fix: version range