Vulnerability · Published Nov 4, 2021 · Assigned by CERTVDE
CVE-2021-34594Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server
Medium 6.5
In plain English
A medium-severity security flaw in TwinCAT OPC UA Server from Beckhoff Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Beckhoff Automation | TwinCAT OPC UA Server | TF6100 – before 4.3.48.0TS6100 – before 4.3.48.0TcOpcUaServer version – before 3.2.0.19423 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
References
- https://cert.vde.com/en/advisories/VDE-2021-051/ x_refsource_CONFIRM