Skip to content
OpenAdvisories
Medium VDE-2024-050 1 CVE

Beckhoff: Denial-of-Service vulnerability in the MDP package included in TwinCAT/BSD operating system

Published Aug 27, 2024 · Updated May 22, 2025 · Revision 5

Vendor: Beckhoff Product: MDP package version Product: TwinCAT/BSD

Summary

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then causes a buffer overflow on stack which in turn lets the process 'MDPService' crash such that the web interface becomes unavailable until next restart or even execute code in the context of user 'root'.

Details

Impact
A local attacker could cause a denial-of-service or execute code in the context of user 'root' via a crafted HTTP request.

Mitigation
Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Remediation
Please update to a recent version of the affected product. In general, Beckhoff recommends updating the entire TwinCAT/BSD operating system to a current version rather than individual packages. Information on updating existing TwinCAT/BSD installations is available in [here:](https://infosys.beckhoff.com/content/1033/twincat_bsd/11780818443.html?id=4222392218353411614). There you will also find information on how to determine the operating system version via the command line. This is also visible via the Beckhoff Device Manager UI. Please note that when updating from the TwinCAT/BSD major version 12, two consecutive upgrades are required.

Vulnerabilities 1

  • High 7.3
    CVE-2024-41176

    Beckhoff: Local Denial of Service issue in package MDP included in TwinCAT/BSD

    The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local attacker to induce a Denial-of-Service (DoS) condition on the daemon and execute code in the context of user “root” via a crafted HTTP request.

    Beckhoff TwinCAT/BSD MDP package ICS / OT

Revision history

  1. #5

    Fix: quotation mark

  2. #4

    Fix: version range

  3. #3

    Fix: list of branches, typo in reference url

  4. #2

    Fix: correct certvde domain, added self-reference

  5. #1

    initial revision

References