Summary
The vulnerabilities allow local low privileged users or processes to gain full system access on the affected devices through exposed IOCTL function calls.
Impact
All three vulnerabilities lead to full compromise of the affected devices.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| TcRouter.sys for Windows on x64 3.1.0.2364 | 3.1.0.2364 | |
| TcRouter.sys for Windows on x64 <3.1.0.2365 | vers:semver/>=1.0.0|<3.1.0.2365 | |
| TcRouter.sys for Windows on x86 3.1.0.2364 | 3.1.0.2364 | |
| TcRouter.sys for Windows on x86 <3.1.0.2365 | vers:semver/>=1.0.0|<3.1.0.2365 | |
| TwinCAT.XAR.Base.KM 3.16.29 | 3.16.29 | |
| TwinCAT.XAR.Base.KM <3.18.1 | vers:semver/>=1.0.0|<3.18.1 |
Vulnerabilities
Expand / Collapse allA local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
Acknowledgments
Beckhoff Automation GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
- Chi Siang Choo from 4rthur Security Team for Reported by (see https://4rthur.ai/ )
- Julian Horoszkiewicz from for Reported by
- Patrick Saif from for Reported by
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 11.11.2026 11:00 | Initial revision. |