CISA + leveranciers
ICS Advisories
Advisories specifiek gericht op industriële besturingssystemen — van CISA ICS-CERT en rechtstreeks van leveranciers (onder meer Siemens, ABB, Schneider Electric, WAGO en Phoenix Contact) — inclusief revisiegeschiedenis (initiële publicatie, Update A, Update B) en gekoppelde CVE's.
1
Gevonden
Advisorydata: live koppeling— laatst opgehaald: 7 november 2026 om 14:22.
Filters
1 actief1 advisories gevonden
VDE-2024-050
Beckhoff: Denial-of-Service vulnerability in the MDP package included in TwinCAT/BSD operating system
Gepubliceerd
27 augustus 2024
Laatste update
22 mei 2025
Gekoppelde CVE's
Getroffen sectoren
Risk evaluation
By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then causes a buffer overflow on stack which in turn lets the process 'MDPService' crash such that the web interface becomes unavailable until next restart or even execute code in the context of user 'root'.
Mitigatiesamenvatting
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.
Revisiegeschiedenis (4)
Initiële publicatie — 13 augustus 2024
initial revision
Update A — 6 november 2024
Fix: correct certvde domain, added self-reference
Update B — 16 januari 2025
Fix: list of branches, typo in reference url
Update C — 11 april 2025
Fix: version range