CVE-2014-5415: critical vulnerability in Beckhoff Embedded PC Images
Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function
Published · Updated
Follow this CVE+ Monitor Embedded PC Images+ Monitor TwinCAT Components featuring Automation Device Specification communication
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 4.3%
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Beckhoff · Embedded PC ImagesBeckhoff · TwinCAT Components featuring Automation Device Specification (ADS) communicationRelated CVEs — Beckhoff Embedded PC Images
In the same product, most dangerous first.
References
https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-001.pdfhttps://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-002.pdfhttps://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-003.pdfhttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2016/icsa-16-278-02.jsonhttps://ics-cert.us-cert.gov/advisories/ICSA-16-278-02https://www.cisa.gov/news-events/ics-advisories/icsa-16-278-02http://www.securityfocus.com/bid/93349