CVE-2024-41175
📋 TL;DR
CVE-2024-41175 is a local denial-of-service vulnerability in the IPC-Diagnostics package of TwinCAT/BSD that allows low-privileged local users to crash the system. This affects industrial control systems running vulnerable versions of TwinCAT/BSD. Attackers with local access can disrupt operations by causing system instability.
💻 Affected Systems
- TwinCAT/BSD
📦 What is this software?
Twincat\/bsd by Beckhoff
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash requiring physical reboot, disrupting industrial processes and causing production downtime.
Likely Case
Service disruption affecting specific TwinCAT/BSD functions, potentially impacting connected industrial equipment.
If Mitigated
Limited impact if proper access controls prevent unauthorized local users from executing the attack.
🎯 Exploit Status
Requires local access with low privileges. No authentication bypass needed beyond local user access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TwinCAT/BSD 1.2.0
Vendor Advisory: https://infosys.beckhoff.com/content/1033/twincat_bsd/11780818443.html?id=4222392218353411614
Restart Required: Yes
Instructions:
1. Download TwinCAT/BSD 1.2.0 from Beckhoff support portal. 2. Backup system configuration. 3. Install update following Beckhoff documentation. 4. Reboot system to apply changes.
🔧 Temporary Workarounds
Remove IPC-Diagnostics package
linuxUninstall the vulnerable IPC-Diagnostics package if not required for operations
pkg delete ipc-diagnostics
Restrict local user access
allImplement strict access controls to limit local user accounts on affected systems
🧯 If You Can't Patch
- Implement strict physical and logical access controls to prevent unauthorized local access
- Monitor system logs for abnormal IPC-Diagnostics activity and implement compensating controls
🔍 How to Verify
Check if Vulnerable:
Check TwinCAT/BSD version: uname -a and verify if below 1.2.0. Check if IPC-Diagnostics package is installed: pkg info | grep ipc-diagnosticsCheck Version:
uname -aVerify Fix Applied:
Confirm version is 1.2.0 or higher: uname -a. Verify IPC-Diagnostics package version if still installed.📡 Detection & Monitoring
Log Indicators:
- System crash logs
- IPC-Diagnostics service failures
- Unexpected process terminations
Network Indicators:
- None - this is a local-only vulnerability
SIEM Query:
Search for system crash events or IPC-Diagnostics service failures in system logs