Authentication Bypass in Device Manager from Vendor
CVE-2025-41727

7.8HIGH

Key Information:

Vendor

Beckhoff Automation

Status
Beckhoff.device.manager.xar
Mdp Software Package For Twincat/bsd
Mdp For Beckhoff Rt Linux(r)
Vendor
CVE Published:
27 January 2026

What is CVE-2025-41727?

A vulnerability exists in the Device Manager that permits local low privileged attackers to bypass authentication mechanisms. This flaw enables unauthorized individuals to execute privileged operations, potentially compromising system security and allowing them administrative access to the application.

Affected Version(s)

Beckhoff.Device.Manager.XAR 0.0.0 < 2.5.3

MDP for Beckhoff RT Linux(R) 0.0.0 < 0.0.5

MDP software package for TwinCAT/BSD 0.0.0 < 1.7.0.0

References

https://certvde.com/de/advisories/VDE-2025-092

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Diego Giubertoni from Nozomi Networks
.