PT-2026-4909 · Unknown · Hp Device Manager

Diego Giubertoni · Published 2026-01-27 · Updated 2026-01-27 · CVE-2025-41726

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Beckhoff.Device.Manager.XAR (affected versions not specified)

Description A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API. This is due to integer overflows, which may lead to arbitrary code execution within privileged processes. The API endpoints are susceptible to crafted calls that trigger the integer overflow. The vulnerable parameters or variables used in these calls are not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2025-41726

Affected Products

Hp Device Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-41726 · Security Note
• https://twitter.com/CVEnew/status/2016116150644469907 · Twitter Post
• https://t.me/cveNotify/149977 · Telegram Post
• https://twitter.com/TheHackerWire/status/2016130245213204783 · Twitter Post
• https://t.me/CVEtracker/43063 · Telegram Post
• https://twitter.com/CveFindCom/status/2016227375046873439 · Twitter Post
• https://certvde.com/de/advisories/VDE-2025-092 · Note
• https://twitter.com/vuldb/status/2016137669886296479 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016199937923453122 · Twitter Post