Description
An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Beckhoff | TE1000 | TwinCAT 3 Enineering | < 3.1.4024.67 | 3.1.4024.67 |
Advisories 1
- VDE-2025-075 Beckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering CERT@VDE · Sep 9, 2025