Back to Database
Status published
Critical
CVE-2014-5415
Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function
Vulnerability Description
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-5415
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Gregor Bonney from FH Aachen University of Applied Sciences
References
- http://www.securityfocus.com/bid/93349
- https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-001.pdf
- https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-002.pdf
- https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-003.pdf
- https://www.cisa.gov/news-events/ics-advisories/icsa-16-278-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2016/icsa-16-278-02.json
More from Beckhoff
View All →CVE-2025-41701
Beckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering
High
7.8
CVE-2024-8934
Beckhoff: Local command injection via TwinCAT Package Manager
Medium
6.5
CVE-2024-41176
Beckhoff: Local Denial of Service issue in package MDP included in TwinCAT/BSD
High
7.3
CVE-2024-41175
Beckhoff: Local Denial-of-Service vulnerability in TwinCAT/BSD and the IPC-Diagnostics package
Medium
5.5
CVE-2024-41174
Beckhoff: Improper input neutralization vulnerability in the IPC-Diagnostics package in TwinCAT/BSD
High
7.3
Affected Vendor
Beckhoff
View all reports →Affected Software
Embedded PC Images, TwinCAT Components featuring Automation Device Specification (ADS) communication
Vulnerable Versions:
0, All
Timeline
Official Publish:
October 5th, 2016
Last Modified:
November 4th, 2025
Added to House:
July 19th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N