CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12510 – Beckhoff: Privilege Escalation through TwinCat System
https://notcve.org/view.php?id=CVE-2020-12510
The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for automatic execution upon log in of a user. If a less privileged user has a local account he or she can replace TcSysUI.exe. It will be executed automatically by another user during login. • https://cert.vde.com/en-us/advisories/vde-2020-037 • CWE-276: Incorrect Default Permissions •
CVSS: 5.3EPSS: 0%CPEs: 63EXPL: 0CVE-2020-12494 – Beckhoff: Etherleak in TwinCAT RT network driver
https://notcve.org/view.php?id=CVE-2020-12494
Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. • https://cert.vde.com/en-us/advisories/vde-2020-019 • CWE-459: Incomplete Cleanup •
CVSS: 9.8EPSS: 2%CPEs: 4EXPL: 1CVE-2019-16871
https://notcve.org/view.php?id=CVE-2019-16871
Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote Code Execution (as SYSTEM) via the Beckhoff ADS protocol. Los PLC Beckhoff Embedded Windows versiones hasta 3.1.4024.0 y Beckhoff Twincat sobre las estaciones de Windows Engineering, permiten a un atacante lograr una ejecución de código remota (como SYSTEM) por medio del protocolo ADS de Beckhoff. • https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2017-001.pdf https://www.ic4.be/2019/12/18/beckhoff-cve-2019-16871/#more-648 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-5636 – Beckhoff TwinCAT Discovery Service Denial of Service
https://notcve.org/view.php?id=CVE-2019-5636
When a Beckhoff TwinCAT Runtime receives a malformed UDP packet, the ADS Discovery Service shuts down. Note that the TwinCAT devices are still performing as normal. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior). Cuando un Beckhoff TwinCAT Runtime recibe un paquete UDP con formato incorrecto, el servicio de descubrimiento de ADS se cierra. Tenga en cuenta que los dispositivos TwinCAT siguen funcionando normalmente. • https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-004.pdf • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-7502
https://notcve.org/view.php?id=CVE-2018-7502
Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges. Los controladores del kernel en Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259 y TwinCAT 3.1 no validan correctamente los valores de puntero proporcionados por el usuario. Un atacante que pueda ejecutar código en el objetivo podría explotar esta vulnerabilidad para obtener privilegios SYSTEM. • http://www.securityfocus.com/bid/103487 https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02 https://srcincite.io/advisories/src-2018-0007 • CWE-20: Improper Input Validation CWE-822: Untrusted Pointer Dereference •