CVE-2025-41701: Beckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering
An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41701?
CVE-2025-41701 is considered a critical vulnerability due to the potential for arbitrary command execution by unauthenticated attackers.
How do I fix CVE-2025-41701?
Fix CVE-2025-41701 by applying the latest security patch provided by Beckhoff for TwinCAT 3 Engineering.
What versions of TwinCAT 3 Engineering are affected by CVE-2025-41701?
CVE-2025-41701 affects all versions of Beckhoff TwinCAT 3 Engineering prior to the security patch release.
Can CVE-2025-41701 be exploited remotely?
No, CVE-2025-41701 requires local access to exploit, as an attacker must trick a user into opening a manipulated project file.
What are the potential consequences of CVE-2025-41701?
Exploitation of CVE-2025-41701 can lead to unauthorized execution of arbitrary commands on the affected system.