CVE-2017-16726 Weak cryptography in Beckhoff TwinCAT

What is CVE-2017-16726?

CVE-2017-16726 is a critical vulnerability in ICS-CERT Beckhoff TwinCAT, published on 27 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve security purposes and therefore does not include any encryption algorithms because of their negative effect on performance and throughput. An attacker can forge arbitrary ADS packets when legitimate ADS traffic is observable.

Weakness: CWE-326, CWE-285

Which versions are affected by CVE-2017-16726?

It affects 1 product.

Products include Beckhoff Twincat.

How do I fix CVE-2017-16726?

No fix has been published for CVE-2017-16726 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-16726 being exploited?

There is no known exploitation of CVE-2017-16726 in the wild and no public exploit code.

Other vulnerabilities in ICS-CERT Beckhoff TwinCAT

• CVE-2019-16871 Auth bypass in n/a Critical 9.8
• CVE-2018-7502 Privilege escalation in Beckhoff TwinCAT PLC products High 7.8
• CVE-2019-5637 Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service High 7.5
• CVE-2017-16718 Weak cryptography in Beckhoff TwinCAT Medium 5.9
• CVE-2020-12494 Beckhoff: Etherleak in TwinCAT RT network driver Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3pcw-vp3f-6hvh.