CISA + leveranciers
ICS Advisories
Advisories specifiek gericht op industriële besturingssystemen — van CISA ICS-CERT en rechtstreeks van leveranciers (onder meer Siemens, ABB, Schneider Electric, WAGO en Phoenix Contact) — inclusief revisiegeschiedenis (initiële publicatie, Update A, Update B) en gekoppelde CVE's.
1
Gevonden
Advisorydata: live koppeling— laatst opgehaald: 7 november 2026 om 14:22.
Filters
1 actief1 advisories gevonden
VDE-2024-064
Beckhoff: Local command injection via TwinCAT Package Manager
Gepubliceerd
31 oktober 2024
Laatste update
11 april 2025
Gekoppelde CVE's
Getroffen sectoren
Risk evaluation
Beckhoff's TwinCAT 3.1 Build 4026 software is modularized and is installed with different packages depending on user requirements. These packages are selected and installed using either the command line utility tcpkg or the corresponding graphical user interface called TwinCAT Package Manager. Both use the same configuration that specifies where to load packages from. These locations are called feeds, have preconfigured default settings and can be customized by administrative users, for example to add another local mirror of a package server. When using the TwinCAT Package Manager on a PC, a user with administrative access rights can locally set a specially crafted URL for a feed that causes the TwinCAT Package Manager to execute arbitrary operating system commands.
Mitigatiesamenvatting
Administrative users shall always act thoroughly and inspect the values which they enter.
Revisiegeschiedenis (3)
Initiële publicatie — 31 oktober 2024
initial revision
Update A — 16 januari 2025
Fix: list of branches, references
Update B — 11 april 2025
Fix: version range