Vulnerability in Beckhoff TwinCAT 3 Affects Industrial Automation Protocols

CVE-2017-16718

What is CVE-2017-16718?

The Beckhoff TwinCAT 3 software, which utilizes the ADS protocol for industrial automation communication, is susceptible to an encryption flaw. This vulnerability arises from the mechanism that allows remote editing of user-defined routes over ADS. The fixed key used for encryption can potentially be extracted by an attacker, which compromises the integrity of the encrypted authentication that requires a username and password. To exploit this vulnerability, an attacker must have network access at the time a route is being added, making it essential for users to secure their networks to mitigate the risk.

References