Share: Email | Twitter

ID

VDE-2024-045

Published

2024-08-27 10:00 (CEST)

Last update

2024-08-27 08:58 (CEST)

Vendor(s)

Beckhoff Automation GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
IPC Diagnostics package < 2.0.0.1
TwinCAT/BSD < 14.1.2.0_153968

Summary

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, the authentication mechanism for the web interface can be bypassed by any local user, regardless of their permissions, and they can act with administrative access rights via this mechanism.


Last Update:

30. August 2024 09:21

Weakness

Authentication Bypass Using an Alternate Path or Channel  (CWE-288) 

Summary

The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.


Impact

A low privileged attacker could bypass the authentication mechanism for the web interface and act as an administrator.

Solution

Mitigation

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Remediation

Please update to a recent version of the affected product. In general, Beckhoff recommends updating the entire TwinCAT/BSD operating system to a current version rather than individual packages. Information on updating existing TwinCAT/BSD installations is available here
There you will also find information on how to determine the operating system version via the command line. This is also visible via the Beckhoff Device Manager UI.
Please note that when updating from the TwinCAT/BSD major version 12, two consecutive upgrades are required.

Reported by

CERT@VDE coordinated with Beckhoff

Reported by Andrea Palanca of Nozomi Networks