Beckhoff Device Manager Privilege Escalation Vulnerability

A vulnerability exists in the Beckhoff Device Manager user interface, allowing local users with low privileges to bypass authentication. This exploitation enables them to perform privileged operations and gain administrator access on Beckhoff IPC or CX devices.

Impact

Exploiting this vulnerability allows local users to escalate privileges, gaining administrator access and the ability to perform privileged operations on the device.

Remediation

Users are advised to update to version 2.5.3 of the Beckhoff Device Manager XAR tcpkg package or to version 2.5.3 of the Beckhoff IPC Diagnostics software for Windows. For TwinCAT/BSD, the MDP software package should be updated to version 1.7.0.0. Beckhoff RT Linux users should update the mdp-bhf software package to version 0.0.5-1. The MDP.dll library for Windows CE 6.0 and Embedded Compact 7 on x86 and ARM32 should also be updated to version 1.7.0.0.