Read the docs
TI-2018-05411 Aliases CVE-2018-7502GHSA-v98p-fx5c-967q

Improper input validation in ICS-CERT Beckhoff TwinCAT PLC products

Priority LOW 35CWE-822Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-822 and the CVSS impact.

Summary

Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges.

Why it matters now

EPSS 0.00557 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ICS-CERTBeckhoff TwinCAT PLC productsTwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, TwinCAT 3.1—No fix listedCNA
  • Beckhoff TwinCAT PLC products VendorICS-CERT Affected TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, TwinCAT 3.1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:beckhoff:twincat:2.11:*:*:*:*:*:*:*2.11VulnerableBeckhoff
cpe:2.3:a:beckhoff:twincat:3.1:*:*:*:*:*:*:*3.1VulnerableBeckhoff
cpe:2.3:a:beckhoff:twincat_c\+\+:3.1:*:*:*:*:*:*:*3.1VulnerableBeckhoff
  • cpe:2.3:a:beckhoff:twincat:2.11:*:*:*:*:*:*:* Versions 2.11 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat_c\+\+:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Beckhoff

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-7502
  2. 2026-10-03 Alias added: GHSA-v98p-fx5c-967q

References

Advisory 2

Other 1

  • TI-2011-03066 Beckhoff TwinCAT 2.11.0.2004 and earlier allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.0
  • TI-2019-12580 Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows… CVSS 3.1CRITICAL 9.8
  • TI-2014-04414 Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts CVSS 3.1CRITICAL 9.1
  • TI-2014-04415 Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function CVSS 3.1CRITICAL 9.1
  • TI-2017-12294 Improper authorization in ICS-CERT Beckhoff TwinCAT CVSS 3.0CRITICAL 9.1
  • TI-2019-04001 Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences