PT-2019-14840 · Beckhoff+1 · Beckhoff Embedded Windows Plcs+2

Published 2019-12-19 · Updated 2021-07-21 · CVE-2019-16871

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Beckhoff Embedded Windows PLCs versions through 3.1.4024.0 Beckhoff Twincat on Windows Engineering stations (affected versions not specified)

Description The issue allows an attacker to achieve remote code execution as SYSTEM via the Beckhoff ADS protocol.

Recommendations For Beckhoff Embedded Windows PLCs versions through 3.1.4024.0, update to a version that contains a fix for this issue. For Beckhoff Twincat on Windows Engineering stations, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2019-16871

Affected Products

Beckhoff Embedded Windows Plcs

Beckhoff Twincat

Windows

References · 4

• 🔥 https://ic4.be/2019/12/18/beckhoff-cve-2019-16871/#more-648 · Exploit
• https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2017-001.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16871 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16871 · Vendor Advisory