CVE-2025-41727
Authentication Bypass in Device Manager Enables Privilege Escalation
Publication date: 2026-01-27
Last updated on: 2026-01-27
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| beckhoff | device_manager | 2.5.3 |
| beckhoff | mdp | 1.7.0.0 |
| beckhoff | mdp_bhf | 0.0.5-1 |
| beckhoff | device_manager | to 2.5.3 (exc) |
| beckhoff | mdp | to 1.7.0.0 (exc) |
| beckhoff | mdp_bhf | to 0.0.5-1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-420 | The product protects a primary channel, but it does not use the same level of protection for an alternate channel. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows a local user with low privileges on Beckhoff Device Manager to bypass the authentication mechanism of its user interface. By doing so, the attacker can send commands to a privileged process that executes them with administrator-level privileges, effectively escalating their access rights on the system. [1]
How can this vulnerability impact me? :
The vulnerability can lead to local privilege escalation, allowing an attacker with low privileges to gain administrator access. This can result in unauthorized execution of commands with high privileges, compromising the confidentiality, integrity, and availability of the affected system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability allows a local low-privileged user to bypass authentication and execute commands with elevated privileges via the Device Manager user interface. Detection involves monitoring for unauthorized command executions or privilege escalations on affected Beckhoff Device Manager components. Specific detection commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the affected Beckhoff software packages to the fixed versions: Beckhoff.Device.Manager.XAR tcpkg package version 2.5.3 or later, MDP software package for TwinCAT/BSD version 1.7.0.0 or later, and mdp-bhf software package for Beckhoff RT Linux(R) version 0.0.5-1 or later. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a local low privileged attacker to bypass authentication and gain administrator access, which can lead to unauthorized access to sensitive data and system controls. Such unauthorized access and potential data compromise could negatively impact compliance with standards and regulations like GDPR and HIPAA that require strict access controls and protection of sensitive information. Therefore, if exploited, this vulnerability could result in non-compliance with these regulations due to breaches in confidentiality, integrity, and availability of data. [1]