doorTijl Deneut
Beckhoff CVE-2019-16871
Windows Remote Code Execution via TwinCAT AMS/ADS
This is a writeup of a technical protocol analysis of TwinCAT. TwinCAT allows remote code execution as soon as a valid route is discovered.
Installing Beckhoff Engineering software on your Windows system can lead to unauthenticated Remote Code Execution as System.
Three prerequisites are necessary
- TwinCAT Runtime Environment installed (any version including the most recent one at time of writing)
- TwinCAT routes configured
- Firewall allows TCP/48898
