CVE-2019-16871

Published: Dec 19, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote Code Execution (as SYSTEM) via the Beckhoff ADS protocol.

Affected (4)

Products: Beckhoff: Twincat

Beckhoff

1 product

Twincat

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Beckhoff Twincat	From 3.0 to 3.1
Beckhoff Twincat	Version 2.0
Beckhoff Twincat	Version 3.1 build_4022
Beckhoff Twincat	Version 3.1 build_4024.0

Related CWEs

CWE-290

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (4)

https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2017-001.pdf

Source: cve@mitre.org

Vendor Advisory

https://www.ic4.be/2019/12/18/beckhoff-cve-2019-16871/#more-648

Source: cve@mitre.org

ExploitThird Party Advisory

https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2017-001.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.ic4.be/2019/12/18/beckhoff-cve-2019-16871/#more-648

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.