Beckhoff TwinCAT Installation Directory Incorrect Default Permissions (CVE-2020-12510)

The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for...

CVE-2020-12510

creationtimestamp| type| source ---|---|--- 2020-11-19 20:41:46+00:00| seen| https://t.me/cibsecurity/16607...

CVE-2020-12510

CVE-2020-12510 concerns Beckhoff’s TwinCAT XAR 3.1. The default installation path is C:\TwinCAT, and if this directory (or subdirectories) does not exist they are created with permissions that allow any local user to modify contents. TcSysUI.exe is registered for automatic execution on user login...