Description
A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Beckhoff Automation | TcRouter.sys for Windows on x64 3.1.0.2364 | 3.1.0.2364 | — |
| Beckhoff Automation | TcRouter.sys for Windows on x64 <3.1.0.2365 | 1.0.0 – < 3.1.0.2365 | 3.1.0.2365 |
| Beckhoff Automation | TcRouter.sys for Windows on x86 3.1.0.2364 | 3.1.0.2364 | — |
| Beckhoff Automation | TcRouter.sys for Windows on x86 <3.1.0.2365 | 1.0.0 – < 3.1.0.2365 | 3.1.0.2365 |
| Beckhoff Automation | TwinCAT.XAR.Base.KM 3.16.29 | 3.16.29 | — |
| Beckhoff Automation | TwinCAT.XAR.Base.KM <3.18.1 | 1.0.0 – < 3.18.1 | 3.18.1 |
Advisories 1
- VDE-2026-087 Beckhoff: Exposed IOCTLs with insufficient access control in TcRouter.sys CERT@VDE · Nov 11, 2026