CVE-2025-41726highCWE-190

CVE-2025-41726: fallo de gravedad alta en Beckhoff.Device.Manager.XAR

Beckhoff: Arbitrary code execution within privileged processes

Publicada el

Seguir esta CVE+ Monitorear Beckhoff.Device.Manager.XAR+ Monitorear MDP for Beckhoff RT Linux

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.5%
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Beckhoff Automation · Beckhoff.Device.Manager.XARBeckhoff Automation · MDP for Beckhoff RT Linux(R)Beckhoff Automation · MDP software package for TwinCAT/BSD
CVEs relacionadas — Beckhoff.Device.Manager.XAR

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-41728MEDIUMBeckhoff: Information leak via Beckhoff Device ManagerEPSS 0.3%CVE-2025-41727HIGHBeckhoff: Performing privileged operations and gaining administrator accessEPSS 0.2%