Remote Code Execution Vulnerability in Beckhoff Embedded Windows PLCs and Twincat
CVE-2019-16871

9.8CRITICAL

Key Information:

Vendor

Beckhoff

Status
Twincat
Vendor
CVE Published:
19 December 2019

What is CVE-2019-16871?

The vulnerability allows remote attackers to execute arbitrary code as SYSTEM on Beckhoff Embedded Windows PLCs and Twincat applications through a flaw in the Beckhoff ADS protocol. This can lead to unauthorized access and control over affected systems, potentially compromising the integrity and availability of critical infrastructure.

References

https://www.ic4.be/2019/12/18/beckhoff-cve-2019-16871/#mo...
x_refsource_MISC
https://download.beckhoff.com/download/document/product-s...
x_refsource_CONFIRM

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.