CVE-2026-18767
Received
Received - Intake
Local Privilege Escalation in TcRouter via Exposed IOCTL
Vulnerability report for CVE-2026-18767, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: CERT VDE
Description
Description
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Beckhoff Automation | TcRouter.sys for Windows on x64 3.1.0.2364 | 3.1.0.2364 |
| Beckhoff Automation | TcRouter.sys for Windows on x64 <3.1.0.2365 | From 1.0.0 (inc) to 3.1.0.2365 (exc) |
| Beckhoff Automation | TcRouter.sys for Windows on x86 3.1.0.2364 | 3.1.0.2364 |
| Beckhoff Automation | TcRouter.sys for Windows on x86 <3.1.0.2365 | From 1.0.0 (inc) to 3.1.0.2365 (exc) |
| Beckhoff Automation | TwinCAT.XAR.Base.KM 3.16.29 | 3.16.29 |
| Beckhoff Automation | TwinCAT.XAR.Base.KM <3.18.1 | From 1.0.0 (inc) to 3.18.1 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-782 | The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL. |
