Summary
The vulnerabilities allow local low privileged users or processes to gain full system access on the affected devices through exposed IOCTL function calls.
Details
All three vulnerabilities lead to full compromise of the affected devices.
Vulnerabilities 3
-
High 8.5
A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL fu…
-
High 7.8
Insufficient IOCTL access control allows local access to I/O ports
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
-
High 7.8
Insufficient IOCTL access control allows local access to arbitrary physical memory
A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
Revision history
-
#1.0.0
Initial revision.
References
-
Beckhoff Security Advisory 2026-001: Exposed IOCTLs with insufficient access control in TcRouter.sys - PDF version
https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2026-001.pdf
-
Additional information about the latest security advisories is provided here:
https://www.beckhoff.com/secinfo
-
CERT@VDE Security Advisories for Beckhoff Automation GmbH & Co. KG
https://certvde.com/en/advisories/vendor/beckhoff/
-
VDE-2026-087: Beckhoff: Exposed IOCTLs with insufficient access control in TcRouter.sys - HTML
https://certvde.com/en/advisories/VDE-2026-087