CVE-2025-41728 Beckhoff: Information leak via Beckhoff Device Manager
A remote attacker can disclose confidential memory information from a privileged process via crafted requests to the Device Manager web service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41728?
CVE-2025-41728 is a medium-severity vulnerability in Beckhoff.Device.Manager.XAR, published on 27 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially copy confidential information into a response.
Weakness: CWE-125
Which versions are affected by CVE-2025-41728?
How do I fix CVE-2025-41728?
No fix has been published for CVE-2025-41728 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-41728 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-41728 exists.
Sources
Also known as GHSA-3gh2-3c3q-2933.