CVE-2025-41726

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Beckhoff Automation	Beckhoff.Device.Manager.XAR	>= 0.0.0, < 2.5.3
Beckhoff Automation	MDP software package for TwinCAT/BSD	>= 0.0.0, < 1.7.0.0
Beckhoff Automation	MDP for Beckhoff RT Linux(R)	>= 0.0.0, < 0.0.5

References

https://certvde.com/de/advisories/VDE-2025-092

Timeline

Published: Jan 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-417277.8A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged oper CVE-2025-417285.3A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending special CVE-2025-417297.5An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service.CVE-2025-41738.8A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function d CVE-2025-417309.8An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size CVE-2025-417317.4A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker wi CVE-2025-417329.8An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size CVE-2025-417339.8The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker CVE-2025-417349.8An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.CVE-2025-417358.8A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.CVE-2025-417368.8A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in CVE-2025-417377.5Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.