CVE-2025-41726
High
Description
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
SeverityHigh
CVSS8.8
Exploit probability—
ProductBeckhoff.Device.Manager.XAR
PublishedJan 27, 2026
First seenJan 27, 2026
Weakness typeCWE-190Integer overflow
How to fix
Update
- Beckhoff Automation Beckhoff.Device.Manager.XAR2.5.3 or later
- Beckhoff Automation MDP software package for TwinCAT/BSD1.7.0.0 or later
- Beckhoff Automation MDP for Beckhoff RT Linux(R)0.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Beckhoff Automation Beckhoff.Device.Manager.XAR | v < 2.5.3 | 2.5.3 |
| Beckhoff Automation MDP software package for TwinCAT/BSD | v < 1.7.0.0 | 1.7.0.0 |
| Beckhoff Automation MDP for Beckhoff RT Linux(R) | v < 0.0.5 | 0.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.