VDE-2024-064
Vulnerability from csaf_beckhoffautomationgmbhcokg - Published: 2024-10-31 11:00 - Updated: 2025-04-11 07:00Summary
Beckhoff: Local command injection via TwinCAT Package Manager
Notes
Summary: Beckhoff's TwinCAT 3.1 Build 4026 software is modularized and is installed with different packages depending on user requirements. These packages are selected and installed using either the command line utility tcpkg or the corresponding graphical user interface called TwinCAT Package Manager. Both use the same configuration that specifies where to load packages from. These locations are called feeds, have preconfigured default settings and can be customized by administrative users, for example to add another local mirror of a package server. When using the TwinCAT Package Manager on a PC, a user with administrative access rights can locally set a specially crafted URL for a feed that causes the TwinCAT Package Manager to execute arbitrary operating system commands.
Impact: A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed.
Mitigation: Administrative users shall always act thoroughly and inspect the values which they enter.
Remediation: Please update to a recent version of the affected product.
Reporting vulnerabilities: Beckhoff Automation welcomes responsibly coordinated reports of vulnerabilities and Beckhoff will collaborate with reporting parties to fix vulnerabilities or mitigate threats.
Disclaimer: Beckhoff is not responsible for any side effects negatively affecting the real-time capabilities of your TwinCAT control application possibly caused by updates. Beckhoff offers updated images with qualified performance for Beckhoff hardware from time to time. TwinCAT System Manager offers tools which can be of assistance to verify real-time performance after update. A backup should be created every time before installing an update. Only administrators or IT experts should perform the backup and update procedure.
6.5 (Medium)
Mitigation
Administrative users shall always act thoroughly and inspect the values which they enter.
Vendor Fix
Please update TwinCAT Package Manager to 1.0.603.0
References
Acknowledgments
CERT@VDE
certvde.com
ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc.
elcazator
ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc.
Elcazator
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination",
"urls": [
"https://certvde.com"
]
},
{
"names": [
"elcazator"
],
"organization": "ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc.",
"summary": "Reporting"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/v1/"
}
},
"lang": "en-US",
"notes": [
{
"category": "summary",
"text": "Beckhoff\u0027s TwinCAT 3.1 Build 4026 software is modularized and is installed with different packages depending on user requirements. These packages are selected and installed using either the command line utility tcpkg or the corresponding graphical user interface called TwinCAT Package Manager. Both use the same configuration that specifies where to load packages from. These locations are called feeds, have preconfigured default settings and can be customized by administrative users, for example to add another local mirror of a package server. When using the TwinCAT Package Manager on a PC, a user with administrative access rights can locally set a specially crafted URL for a feed that causes the TwinCAT Package Manager to execute arbitrary operating system commands.",
"title": "Summary"
},
{
"category": "description",
"text": "A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed.",
"title": "Impact"
},
{
"category": "description",
"text": "Administrative users shall always act thoroughly and inspect the values which they enter.",
"title": "Mitigation"
},
{
"category": "description",
"text": "Please update to a recent version of the affected product.",
"title": "Remediation"
},
{
"category": "general",
"text": "Beckhoff Automation welcomes responsibly coordinated reports of vulnerabilities and Beckhoff will collaborate with reporting parties to fix vulnerabilities or mitigate threats.",
"title": "Reporting vulnerabilities"
},
{
"category": "legal_disclaimer",
"text": "Beckhoff is not responsible for any side effects negatively affecting the real-time capabilities of your TwinCAT control application possibly caused by updates. Beckhoff offers updated images with qualified performance for Beckhoff hardware from time to time. TwinCAT System Manager offers tools which can be of assistance to verify real-time performance after update. A backup should be created every time before installing an update. Only administrators or IT experts should perform the backup and update procedure.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "product-securityincident@beckhoff.com",
"name": "Beckhoff Automation GmbH \u0026 Co. KG",
"namespace": "https://www.beckhoff.com"
},
"references": [
{
"category": "self",
"summary": "Beckhoff Security Advisory 2024-005: Local command injection via TwinCAT Package Manager - PDF",
"url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2024-005.pdf"
},
{
"category": "external",
"summary": "Additional information about the latest IPC security advisories is provided here:",
"url": "https://www.beckhoff.com/secinfo"
},
{
"category": "external",
"summary": "CERT@VDE Security Advisories for Beckhoff Automation GmbH \u0026 Co. KG",
"url": "https://certvde.com/en/advisories/vendor/beckhoff/"
},
{
"category": "self",
"summary": "VDE-2024-064: Beckhoff: Local command injection via TwinCAT Package Manager - CSAF",
"url": "https://beckhoff.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-064.json"
},
{
"category": "self",
"summary": "VDE-2024-064: Beckhoff: Local command injection via TwinCAT Package Manager - HTML",
"url": "https://certvde.com/en/advisories/vde-2024-064"
}
],
"title": "Beckhoff: Local command injection via TwinCAT Package Manager",
"tracking": {
"aliases": [
"VDE-2024-064"
],
"current_release_date": "2025-04-11T07:00:00.000Z",
"generator": {
"date": "2025-04-11T07:36:54.283Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.23"
}
},
"id": "VDE-2024-064",
"initial_release_date": "2024-10-31T11:00:00.000Z",
"revision_history": [
{
"date": "2024-10-31T11:00:00.000Z",
"number": "1",
"summary": "initial revision"
},
{
"date": "2025-01-16T10:30:00.000Z",
"number": "2",
"summary": "Fix: list of branches, references"
},
{
"date": "2025-04-11T07:00:00.000Z",
"number": "3",
"summary": "Fix: version range"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.0.603.0",
"product": {
"name": "TwinCAT Package Manager \u003c1.0.603.0",
"product_id": "CSAFPID-51001"
}
},
{
"category": "product_version",
"name": "1.0.603.0",
"product": {
"name": "TwinCAT Package Manager 1.0.603.0",
"product_id": "CSAFPID-52001"
}
}
],
"category": "product_name",
"name": "TwinCAT Package Manager"
}
],
"category": "product_family",
"name": "Software"
}
],
"category": "vendor",
"name": "Beckhoff"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Elcazator"
],
"organization": "ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc.",
"summary": "Elcazator reported the vulnerability to Beckhoff"
}
],
"cve": "CVE-2024-8934",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed.",
"title": "Summary"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"release_date": "2024-09-27T07:00:00.000Z",
"remediations": [
{
"category": "mitigation",
"date": "2024-09-27T07:00:00.000Z",
"details": "Administrative users shall always act thoroughly and inspect the values which they enter.",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Please update TwinCAT Package Manager to 1.0.603.0",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2024-8934"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…