CVE-2025-41726: Beckhoff Device Manager Integer Overflow Leads to Remote Code Execution on IPC/CX Devices

CVE-2025-41726 is a high-severity integer overflow vulnerability (CWE-190) in the Device Manager web service that Beckhoff bundles on its industrial PC and CX-series embedded controller firmware images: a low-privileged remote attacker can send specially crafted calls to the Device Manager's web service, or reach the same flaw locally via its API, to trigger an integer overflow that leads to arbitrary code execution inside a privileged process on the device, and CERT@VDE's own coordinated score for the flaw is CVSS v3.1 8.8 (high); NVD has not yet published its own Primary CVSS score.

CVE-2025-41726 (CWE-190, integer overflow or wraparound) affects the Device Manager component (Beckhoff.Device.Manager.XAR) that ships as part of the Modular Device Profile (MDP) software on Beckhoff's industrial PCs and CX-series embedded PLCs. NVD's description states: "A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes" (NVD).

CERT@VDE's coordinated advisory VDE-2025-092 bundles this flaw with a second, related issue, CVE-2025-41727 (an unprotected alternate channel, CWE-420, that lets a local low-privileged user bypass Device Manager authentication to gain administrator access, CVSS v3.1 7.8). The advisory lists the affected components as Beckhoff.Device.Manager.XAR before version 2.5.3, the MDP software package for TwinCAT/BSD before 1.7.0.0, and MDP for Beckhoff RT Linux before 0.0.5-1 — spanning the Windows Embedded Compact, Windows CE, TwinCAT/BSD and RT Linux firmware variants Beckhoff ships on its CX embedded controllers (CERT@VDE VDE-2025-092).

NVD tracks CVE-2025-41726 with status "Deferred" as of this review: it records only a CERT@VDE-submitted score (source [email protected]) — CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD). The vector's AV:N and PR:L mean the vendor-coordinated analysis treats this as remotely reachable with only low privileges required, consistent with NVD's description of a "low privileged remote attacker."

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00482 (41.814th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of affected Beckhoff IPC/CX devices should update the Device Manager and MDP components to the fixed versions listed above, and restrict network access to the Device Manager's web service to trusted management networks.

• A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes. — NVD
• Affects Beckhoff.Device.Manager.XAR before 2.5.3, MDP software package for TwinCAT/BSD before 1.7.0.0, and MDP for Beckhoff RT Linux before 0.0.5-1; bundled in the same advisory as the related CVE-2025-41727 local authentication-bypass flaw (CVSS v3.1 7.8). — CERT@VDE VDE-2025-092
• NVD status 'Deferred'; records only CERT@VDE's own Secondary CVSS v3.1 score of 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no NVD-published Primary score as of this review. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00482 (41.814th percentile) as of 2026-11-07. — FIRST EPSS