Beckhoff
19 CVEs across 36 Beckhoff products. Browse Beckhoff vulnerabilities, severities, and proof-of-concept exploits.
Beckhoff products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41701 | High | 7.8 | 2025-09-09 | An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engine… |
CVE-2024-8934 | Medium | 6.5 | 2024-10-31 | A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which t… |
CVE-2024-41176 | High | 7.3 | 2024-08-27 | The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local attacker to induce a Denial-of-Service (DoS) condition on the daemon and… |
CVE-2024-41175 | Medium | 5.5 | 2024-08-27 | The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker. |
CVE-2024-41174 | High | 7.3 | 2024-08-27 | The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker. |
CVE-2024-41173 | High | 7.8 | 2024-08-27 | The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker. |
CVE-2023-6545 | Medium | 4.7 | 2023-12-14 | The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to anothe… |
CVE-2021-34594 | Medium | 6.5 | 2021-11-04 | TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path trav… |
CVE-2020-20741 | Critical | 9.8 | 2021-07-23 | Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6 allows remote attackers to… |
CVE-2020-12526 | Medium | 5.3 | 2021-05-13 | TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable… |
CVE-2020-12510 | High | 7.3 | 2020-11-19 | The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirec… |
CVE-2020-12494 | Medium | 5.3 | 2020-06-16 | Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethern… |
CVE-2020-9464 | High | 7.5 | 2020-03-12 | A Denial-of-Service vulnerability exists in BECKHOFF Ethernet TCP/IP Bus Coupler BK9000. After an attack has occurred, the device's functionality can be restor… |
CVE-2019-16871 | Critical | 9.8 | 2019-12-19 | Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote Code Execution (as… |
CVE-2019-5637 | High | 7.5 | 2019-11-21 | When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the… |
CVE-2019-5636 | Medium | 5.3 | 2019-11-21 | When a Beckhoff TwinCAT Runtime receives a malformed UDP packet, the ADS Discovery Service shuts down. Note that the TwinCAT devices are still performing as no… |
CVE-2017-16726 | Critical | 9.1 | 2018-06-27 | Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve s… |
CVE-2017-16718 | Medium | 5.9 | 2018-06-27 | Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured r… |
CVE-2018-7502 | High | 7.8 | 2018-03-23 | Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker… |
CVE-2014-5415 | Critical | 9.1 | 2016-10-05 | Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via th… |
CVE-2014-5414 | Critical | 9.1 | 2016-10-05 | Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components do not restrict the number of authentication attempt… |
CVE-2015-4051 | | 2015-06-08 | Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (rebo… | |
CVE-2011-3486 | | 2011-09-16 | Beckhoff TwinCAT 2.11.0.2004 and earlier allows remote attackers to cause a denial of service via a crafted request to UDP port 48899, which triggers an out-of… |