Maandelijks archief december 2019

doorTijl Deneut

Beckhoff CVE-2019-16871

Windows Remote Code Execution via TwinCAT AMS/ADS

This is a writeup of a technical protocol analysis of TwinCAT. TwinCAT allows remote code execution as soon as a valid route is discovered.

Installing Beckhoff Engineering software on your Windows system can lead to unauthenticated Remote Code Execution as System.

Three prerequisites are necessary

  • TwinCAT Runtime Environment installed (any version including the most recent one at time of writing)
  • TwinCAT routes configured
  • Firewall allows TCP/48898
Lees meer