CVE-2014-5414: beckhoff embedded_pc_images
CVSS: 9.4v2.0HighModified
Published 05-10-2016Last modified 04-11-2025
Vulnerability summary
CVE-2014-5414 is a high (CVSS 9.4) vulnerability in beckhoff embedded_pc_images. EPSS estimates a 4.80% chance of exploitation in the next 30 days, higher than 91.9% of scored vulnerabilities.
CVSS score
9.4/10
010
High · v2.0 (NVD)EPSS score
4.80%
0%100%
Low · +0.24 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 05-10-2016PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components do not restrict the number of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS metrics
4 scores · 2 sources · 3 versionsCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 2 agree
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Critical 9.1Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesSingle source
High 9.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:C/I:C/A:NSourcesSingle source
EPSS trend
Probability
4.80%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
+0.24 pp
From 4.56% on 21-09-2026
21-09-202621-10-2026
EPSS score4.80%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-307Improper Restriction of Excessive Authentication AttemptsThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
- CWE-2547PK - Security FeaturesSoftware security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Affected systems
Beckhoff3 products
- embedded_pc_images< October 22, 2014 | na
- twincatna
- twincat components featuring automation device specification (ads) communicationAll
1 vendor · 3 products
References
7 links- ics-cert.us-cert.gov/advisories/ICSA-16-278-02X Refsource MISCX TransferredThird Party AdvisoryUS Government Resource