Remote Information Disclosure Flaw in Device Manager Web Service
CVE-2025-41728

5.3MEDIUM

Key Information:

Vendor

Beckhoff Automation

Status
Beckhoff.device.manager.xar
Mdp Software Package For Twincat/bsd
Mdp For Beckhoff Rt Linux(r)
Vendor
CVE Published:
27 January 2026

What is CVE-2025-41728?

A vulnerability exists in the Device Manager web service, where a remote attacker with low privileges can exploit this flaw to disclose sensitive information from the memory of a privileged process. By sending specially crafted requests, the attacker can trigger an out-of-bounds read operation, potentially exposing confidential information in the service's response due to weaknesses in Address Space Layout Randomization (ASLR). This vulnerability poses significant privacy risks, necessitating immediate attention and remediation.

Affected Version(s)

Beckhoff.Device.Manager.XAR 0.0.0 < 2.5.3

MDP for Beckhoff RT Linux(R) 0.0.0 < 0.0.5

MDP software package for TwinCAT/BSD 0.0.0 < 1.7.0.0

References

https://certvde.com/de/advisories/VDE-2025-092

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Diego Giubertoni from Nozomi Networks
.