What’s Vulnerable › Vulnerabilities

CVE-2019-16871

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-19 · updated 2026-06-17
• Weakness: CWE-290

Description

Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote Code Execution (as SYSTEM) via the Beckhoff ADS protocol.

Affected products

• ICS-CERT Beckhoff TwinCAT: from 3.0 before 3.1; 2.0, 3.1-build_4022, 3.1-build_4024.0 — fixed in 3.1

How to fix

Upgrade to a fixed version: ICS-CERT Beckhoff TwinCAT 3.1. Check the vendor advisory for mitigations.

References

• https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2017-001.pdf
• https://www.ic4.be/2019/12/18/beckhoff-cve-2019-16871/#more-648
• https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2017-001.pdf
• https://www.ic4.be/2019/12/18/beckhoff-cve-2019-16871/#more-648

Get alerted when CVE-2019-16871 or the next vulnerability affects your stack