Beckhoff Embedded PC Images and TwinCAT Components Vulnerabilities

Vulnerabilities 2

• Critical 9.1
  CVE-2014-5414

  Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts

  Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components do not restrict the number of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

  Beckhoff Embedded PC Images TwinCAT Components featuring Automation Device Specification (ADS) communication ICS / OT
  Oct 5, 2016
• Critical 9.1
  CVE-2014-5415

  Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function

  Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.

  Beckhoff TwinCAT Components featuring Automation Device Specification (ADS) communication Embedded PC Images ICS / OT
  Oct 5, 2016

Revision history

1. 2025-06-09 #2

   Advisory converted into a CSAF

2. 2016-07-08 #1

   Initial Publication

References

• ICS Advisory ICSA-16-278-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-16-278-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014