Remote Code Execution Vulnerability in Device Manager by Vendor
CVE-2025-41726

8.8HIGH

Key Information:

Vendor

Beckhoff Automation

Status
Beckhoff.device.manager.xar
Mdp Software Package For Twincat/bsd
Mdp For Beckhoff Rt Linux(r)
Vendor
CVE Published:
27 January 2026

What is CVE-2025-41726?

A vulnerability exists in the Device Manager that allows low-privileged remote attackers to execute arbitrary code. This can be achieved by sending specially crafted requests to the web service or via the API, leading to potential integer overflow scenarios. Exploitation of this flaw may enable attackers to launch arbitrary code execution within processes that have elevated privileges.

Affected Version(s)

Beckhoff.Device.Manager.XAR 0.0.0 < 2.5.3

MDP for Beckhoff RT Linux(R) 0.0.0 < 0.0.5

MDP software package for TwinCAT/BSD 0.0.0 < 1.7.0.0

References

https://certvde.com/de/advisories/VDE-2025-092

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Diego Giubertoni from Nozomi Networks
.