PT-2024-7561 · Beckhoff · Twincat Package Manager

Elcazator · Published 2024-10-31 · Updated 2024-11-23 · CVE-2024-8934

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TwinCAT Package Manager (affected versions not specified)

Description A local user with administrative access rights can enter specially crafted values for settings at the user interface (UI) of the TwinCAT Package Manager, which can cause arbitrary OS commands to be executed. The vulnerability is related to the lack of measures to neutralize special elements. Exploitation of the vulnerability may allow an attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-08965

CVE-2024-8934

Affected Products

Twincat Package Manager

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-8934 · Security Note
• https://bdu.fstec.ru/vul/2024-08965 · Security Note
• https://twitter.com/jymgonza/status/1856329390897897875 · Twitter Post
• https://twitter.com/johndjohnson/status/1856417190947217708 · Twitter Post
• https://t.me/cvedetector/9502 · Telegram Post
• https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2024-005.pdf · Note
• https://twitter.com/thecyberwall/status/1854689094770868454 · Twitter Post
• https://certvde.com/en/advisories/VDE-2024-064 · Note
• https://twitter.com/VulmonFeeds/status/1852001502744772708 · Twitter Post
• https://twitter.com/transilienceai/status/1860187623152844989 · Twitter Post
• https://twitter.com/CVEnew/status/1851981020188303468 · Twitter Post
• https://cert.vde.com/en/advisories/VDE-2024-064 · Note
• https://twitter.com/transilienceai/status/1859099583525069153 · Twitter Post