{"id":"CVE-2024-8934","state":"PUBLISHED","title":"Beckhoff: Local command injection via TwinCAT Package Manager","description":"A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed.","publishedAt":"2024-10-31T12:44:44.638Z","updatedAt":"2024-10-31T13:47:50.093Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["Beckhoff TwinCAT Package Manager"],"affected":[{"vendor":"Beckhoff","product":"TwinCAT Package Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.603.0","versionType":"semver"}]}],"references":["https://cert.vde.com/en/advisories/VDE-2024-064"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8934.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-8934","state":"PUBLISHED","datePublished":"2024-10-31T12:44:44.638Z","dateUpdated":"2024-10-31T13:47:50.093Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2024-09-17T07:33:02.586Z"},"containers":{"cna":{"title":"Beckhoff: Local command injection via TwinCAT Package Manager","descriptions":[{"lang":"en","value":"A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed."}],"affected":[{"vendor":"Beckhoff","product":"TwinCAT Package Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.603.0","versionType":"semver"}]}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2024-064"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2024-10-31T12:44:44.638Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"elcazator"},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc."}],"source":{"advisory":"VDE-2024-064","defect":["CERT@VDE#641688"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"beckhoff","product":"twincat_packet_manager","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.0.603.0","versionType":"semver"}],"cpes":["cpe:2.3:a:beckhoff:twincat_packet_manager:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-31T13:45:45.494065Z","id":"CVE-2024-8934","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-31T13:47:50.093Z"}}]}}}