PT-2026-4909 · Unknown · Hp Device Manager

Diego Giubertoni · Publicado 2026-01-27 · Atualizado 2026-01-27 · CVE-2025-41726

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Beckhoff.Device.Manager.XAR (affected versions not specified)

Description A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API. This is due to integer overflows, which may lead to arbitrary code execution within privileged processes. The API endpoints are susceptible to crafted calls that trigger the integer overflow. The vulnerable parameters or variables used in these calls are not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2025-41726

Produtos afetados

Hp Device Manager

Referências · 9

• https://twitter.com/CVEnew/status/2016116150644469907 · Publicação no Twitter
• https://t.me/cveNotify/149977 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2016130245213204783 · Publicação no Twitter
• https://t.me/CVEtracker/43063 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2016227375046873439 · Publicação no Twitter
• https://certvde.com/de/advisories/VDE-2025-092 · Nota
• https://twitter.com/vuldb/status/2016137669886296479 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-41726 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2016199937923453122 · Publicação no Twitter