Back to Database
Status published
Medium
CVE-2021-34594
Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server
Vulnerability Description
TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34594
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Beckhoff Automation thanks Johannes Olegård, Emre Süren, and Robert Lagerström for reporting the issue and for support and efforts with the coordinated disclosure.
More from Beckhoff Automation
View All →CVE-2025-41768
Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
Medium
5.5
CVE-2025-41728
Beckhoff: Information leak via Beckhoff Device Manager
Medium
5.3
CVE-2025-41727
Beckhoff: Performing privileged operations and gaining administrator access
High
7.8
CVE-2025-41726
Beckhoff: Arbitrary code execution within privileged processes
High
8.8
Affected Vendor
Beckhoff Automation
View all reports →Affected Software
TwinCAT OPC UA Server
Vulnerable Versions:
TF6100, TS6100, TcOpcUaServer version
Timeline
Official Publish:
November 4th, 2021
Last Modified:
September 16th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H