CVE-2020-12510: beckhoff twincat_extended_automation_runtime Incorrect Default Permissions
Vulnerability summary
CVE-2020-12510 is a high (CVSS 7.3) Incorrect Default Permissions vulnerability in beckhoff twincat_extended_automation_runtime. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.5% of scored vulnerabilities.
Timeline
- 19-11-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for automatic execution upon log in of a user. If a less privileged user has a local account he or she can replace TcSysUI.exe. It will be executed automatically by another user during login. This is also true for users with administrative access. Consequently, a less privileged user can trick a higher privileged user into executing code he or she modified this way. By default Beckhoff’s IPCs are shipped with TwinCAT software installed this way and with just a single local user configured. Thus the vulnerability exists if further less privileged users have been added.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.88% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Beckhoff2 products
1 vendor · 2 products