CVE-2025-41726 — Beckhoff: Arbitrary code execution within privileged processes

CVE-2025-41726

Beckhoff: Arbitrary code execution within privileged processes PUBLISHED

Description (CNA)

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Affected (CNA)

Vendor / product	Versions
Beckhoff Automation / Beckhoff.Device.Manager.XAR	affected 0.0.0 before 2.5.3
Beckhoff Automation / MDP software package for TwinCAT/BSD	affected 0.0.0 before 1.7.0.0
Beckhoff Automation / MDP for Beckhoff RT Linux(R)	affected 0.0.0 before 0.0.5

CWE

CWE-190

References

https://certvde.com/de/advisories/VDE-2025-092

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.