CVE-2025-41726highCWE-190

CVE-2025-41726: high-severity vulnerability in Beckhoff.Device.Manager.XAR

Beckhoff: Arbitrary code execution within privileged processes

Published

Follow this CVE+ Monitor Beckhoff.Device.Manager.XAR+ Monitor MDP for Beckhoff RT Linux

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.5%
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Beckhoff Automation · Beckhoff.Device.Manager.XARBeckhoff Automation · MDP for Beckhoff RT Linux(R)Beckhoff Automation · MDP software package for TwinCAT/BSD
Related CVEs — Beckhoff.Device.Manager.XAR

In the same product, most dangerous first.

CVE-2025-41728MEDIUMBeckhoff: Information leak via Beckhoff Device ManagerEPSS 0.3%CVE-2025-41727HIGHBeckhoff: Performing privileged operations and gaining administrator accessEPSS 0.2%