CVE-2017-16718

2018-06-2700:00:00

CWE-522

icscert

www.cve.org

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.6%

JSON

Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured routes, that can be edited remotely via ADS. This special command supports encrypted authentication with username/password. The encryption uses a fixed key, that could be extracted by an attacker. Precondition of the exploitation of this weakness is network access at the moment a route is added.

CNA Affected

[
  {
    "product": "Beckhoff TwinCAT",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "Version 3"
      }
    ]
  }
]