CVE-2025-41728

A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially copy confidential information into a response.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - info@cert.vde.com

Published

2026-01-27

Last modified

2026-01-27

Weaknesses

CWE-125

Affected products

• Beckhoff.device.manager.xar (Beckhoff Automation)
• Mdp For Beckhoff Rt Linuxr (Beckhoff Automation)
• Mdp Software Package For Twincatbsd (Beckhoff Automation)

References

• https://certvde.com/de/advisories/VDE-2025-092