CVE-2014-5415: Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function

Severity: critical (CVSS 9.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-10-05 · updated 2026-06-17
Weakness: CWE-749

Description

Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.

Affected products

Beckhoff Embedded PC Images: all versions
ICS-CERT Beckhoff TwinCAT: all versions

References

http://www.securityfocus.com/bid/93349
https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-001.pdf
https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-002.pdf
https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-003.pdf
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2016/icsa-16-278-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-16-278-02
http://www.securityfocus.com/bid/93349
https://ics-cert.us-cert.gov/advisories/ICSA-16-278-02

Get alerted when CVE-2014-5415 or the next vulnerability affects your stack