Read the docs
TI-2020-10019 Aliases CVE-2020-12526GHSA-53xf-f462-gx5v

BECKHOFF: DoS-Vulnerability for TwinCAT OPC UA Server and IPC Diagnostics UA Server

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to the running OPC UA server. After some of these requests the OPC UA server is no longer responsive to any client. This is without effect to the real-time functionality of IPCs.

Why it matters now

EPSS 0.00955 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BeckhoffTwinCAT OPC UA Serverup to 2.3.0.12—No fix listedCNA
BeckhoffIPC Diagnostics UA Serverup to 3.1.0.1—No fix listedCNA
BeckhoffTF6100up to 3.3.18—No fix listedCNA
  • TwinCAT OPC UA Server VendorBeckhoff Affected up to 2.3.0.12 Fixed in — No fix listed CNA
  • IPC Diagnostics UA Server VendorBeckhoff Affected up to 3.1.0.1 Fixed in — No fix listed CNA
  • TF6100 VendorBeckhoff Affected up to 3.3.18 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:beckhoff:ipc_diagnostics_ua_server:*:*:*:*:*:*:*:*up to 3.1.0.1VulnerableBeckhoff
cpe:2.3:a:beckhoff:tf6100:*:*:*:*:*:*:*:*up to 3.3.18VulnerableBeckhoff
cpe:2.3:a:beckhoff:twincat_opc_ua_server:*:*:*:*:*:*:*:*up to 2.3.0.12VulnerableBeckhoff
  • cpe:2.3:a:beckhoff:ipc_diagnostics_ua_server:*:*:*:*:*:*:*:* Versions up to 3.1.0.1 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:tf6100:*:*:*:*:*:*:*:* Versions up to 3.3.18 Vulnerable ·Beckhoff
  • cpe:2.3:a:beckhoff:twincat_opc_ua_server:*:*:*:*:*:*:*:* Versions up to 2.3.0.12 Vulnerable ·Beckhoff

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-12526
  2. 2026-10-03 Alias added: GHSA-53xf-f462-gx5v

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences