CVE-2025-41726

published 2026-01-27

CVE-2025-41726: A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API…

Priority P2 60 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
beckhoff_automation	beckhoff.device.manager.xar	>= 0.0.0 < 2.5.3	2.5.3
beckhoff_automation	mdp_for_beckhoff_rt_linux	>= 0.0.0 < 0.0.5	0.0.5
beckhoff_automation	mdp_software_package_for_twincat_bsd	>= 0.0.0 < 1.7.0.0	1.7.0.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-190