Read the docs
TI-2020-09989 Aliases CVE-2020-12494GHSA-92f3-r9r6-rrfr

Beckhoff: Etherleak in TwinCAT RT network driver

Priority LOW 26CWE-459Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.

Why it matters now

EPSS 0.01014 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BeckhoffTwinCat Driver for Intel 8254x (Tcl8254x.sys)up to 3.1.0.3603 for TwinCAT 3.1 4024; up to 3.1.0.3512 for TwinCAT 3.1 4022; up to 2.11.0.2120 for TwinCAT 2.11 2350—No fix listedCNA
BeckhoffTwinCat Driver for Intel 8255x (Tcl8255x.sys)up to 3.1.0.3600 for TwinCAT 3.1 4024; up to 3.1.0.3500 for TwinCAT 3.1 4024; up to 2.11.0.2117 for TwinCAT 2.11 2350—No fix listedCNA
  • TwinCat Driver for Intel 8254x (Tcl8254x.sys) VendorBeckhoff Affected up to 3.1.0.3603 for TwinCAT 3.1 4024; up to 3.1.0.3512 for TwinCAT 3.1 4022; up to 2.11.0.2120 for TwinCAT 2.11 2350 Fixed in — No fix listed CNA
  • TwinCat Driver for Intel 8255x (Tcl8255x.sys) VendorBeckhoff Affected up to 3.1.0.3600 for TwinCAT 3.1 4024; up to 3.1.0.3500 for TwinCAT 3.1 4024; up to 2.11.0.2117 for TwinCAT 2.11 2350 Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:beckhoff:twincat_driver:*:*:*:*:*:*:*:*up to 3.1.0.3603VulnerableBeckhoff
cpe:2.3:a:beckhoff:twincat:3.1:build_4024:*:*:*:*:*:*3.1 build_4024Running onBeckhoff
cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
  • cpe:2.3:a:beckhoff:twincat_driver:*:*:*:*:*:*:*:* Versions up to 3.1.0.3603 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat:3.1:build_4024:*:*:*:*:*:* Versions 3.1 build_4024 Running on ·Beckhoff
  • cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82547ei:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*up to 3.1.0.3512VulnerableBeckhoff
cpe:2.3:a:beckhoff:twincat:3.1:build_4022:*:*:*:*:*:*3.1 build_4022Running onBeckhoff
cpe:2.3:h:intel:82547ei_:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*up to 2.11.0.2120VulnerableBeckhoff
cpe:2.3:a:beckhoff:twincat:2.11:build_2350:*:*:*:*:*:*2.11 build_2350Running onBeckhoff
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*up to 3.1.0.3600VulnerableBeckhoff
cpe:2.3:a:beckhoff:twincat:3.1:build_402:*:*:*:*:*:*3.1 build_402Running onBeckhoff
cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*up to 3.1.0.3500; up to 2.11.0.2117VulnerableBeckhoff
  • cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82547ei:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:* Versions up to 3.1.0.3512 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat:3.1:build_4022:*:*:*:*:*:* Versions 3.1 build_4022 Running on ·Beckhoff
  • cpe:2.3:h:intel:82547ei_:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:* Versions up to 2.11.0.2120 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat:2.11:build_2350:*:*:*:*:*:* Versions 2.11 build_2350 Running on ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:* Versions up to 3.1.0.3600 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat:3.1:build_402:*:*:*:*:*:* Versions 3.1 build_402 Running on ·Beckhoff
  • cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:* Versions up to 3.1.0.3500; up to 2.11.0.2117 Vulnerable ·Beckhoff

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-12494
  2. 2026-10-03 Alias added: GHSA-92f3-r9r6-rrfr

References

Advisory 1

  • TI-2011-03066 Beckhoff TwinCAT 2.11.0.2004 and earlier allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.0
  • TI-2019-12580 Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows… CVSS 3.1CRITICAL 9.8
  • TI-2014-04414 Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts CVSS 3.1CRITICAL 9.1
  • TI-2014-04415 Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function CVSS 3.1CRITICAL 9.1
  • TI-2017-12294 Improper authorization in ICS-CERT Beckhoff TwinCAT CVSS 3.0CRITICAL 9.1
  • TI-2019-04001 Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences