What’s Vulnerable › Vulnerabilities
CVE-2025-41726: Beckhoff: Arbitrary code execution within privileged processes
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-27 · updated 2026-06-17
- Weakness: CWE-190
Description
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
Affected products
- Beckhoff Automation Beckhoff.Device.Manager.XAR: before 2.5.3 — fixed in 2.5.3
- Beckhoff Automation MDP for Beckhoff RT Linux(R): before 0.0.5 — fixed in 0.0.5
- Beckhoff Automation MDP software package for TwinCAT/BSD: before 1.7.0.0 — fixed in 1.7.0.0
How to fix
Upgrade to a fixed version: Beckhoff Automation Beckhoff.Device.Manager.XAR 2.5.3; Beckhoff Automation MDP for Beckhoff RT Linux(R) 0.0.5; Beckhoff Automation MDP software package for TwinCAT/BSD 1.7.0.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-41726 or the next vulnerability affects your stack