PT-2024-8730 · Beckhoff · Twincat/Bsd

Andrea Palanca + 1 · Published 2024-08-27 · Updated 2024-10-01 · CVE-2024-41176

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions TwinCAT/BSD (affected versions not specified)

Description The issue is related to a buffer overflow in the MPD package of TwinCAT/BSD, which can be exploited by an authenticated, low-privileged local attacker. This can lead to a Denial-of-Service (DoS) condition on the daemon and allow the execution of code in the context of the "root" user via a crafted HTTP request. The exploitation can potentially result in system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-120

Related Identifiers

BDU:2024-10334

CVE-2024-41176

Affected Products

Twincat/Bsd

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-41176 · Security Note
• https://cert.vde.com/en/advisories/VDE-2024-050 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10334 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41176 · Vendor Advisory
• https://twitter.com/oktsec/status/1828375478693962204 · Twitter Post
• https://t.me/cvenotify/92250 · Telegram Post
• https://certvde.com/en/advisories/VDE-2024-050 · Note
• https://twitter.com/VulmonFeeds/status/1828383636170666488 · Twitter Post
• https://twitter.com/CVEnew/status/1828346687779123327 · Twitter Post
• https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2024-004.pdf · Note
• https://t.me/cvedetector/4234 · Telegram Post