CVE-2020-12510

Executive Summary

CVE-2020-12510 is a local privilege escalation vulnerability in Beckhoff TwinCAT XAR 3.1 industrial automation software, present in all versions when installed to the default path C:\TwinCAT. The vulnerability stems from insecure directory creation permissions that allow any local user to modify the installation content, combined with the automatic execution of TcSysUI.exe at user login. A less-privileged local user can replace this executable with malicious code, which will be executed when a higher-privileged user — including administrators — logs into the system. The vulnerability carries a CVSS score of 7.3 and affects Beckhoff Industrial PC (IPC) deployments that ship with TwinCAT pre-installed with only a single local user, becoming exploitable when additional lower-privileged accounts are created. Successful exploitation grants code execution in the context of the targeted higher-privileged user, representing a significant risk in industrial control system (ICS) environments where such endpoints are commonly deployed.

Technical Analysis

The technical root cause of CVE-2020-12510 is a combination of two distinct weaknesses in the default installation behavior of Beckhoff TwinCAT XAR 3.1:

1. Insecure Directory Creation: When the TwinCAT XAR 3.1 software is installed to the default path C:\TwinCAT, the installer creates the directory and all necessary subdirectories with file system permissions (Discretionary Access Control Lists, or DACLs) that allow every local user on the system, including non-privileged accounts, to modify the content within these directories. This is a classic "insecure default permissions" vulnerability class, where the vendor fails to apply the principle of least privilege during installation. The permissions effectively grant write and modify access to Authenticated Users or potentially even Everyone, which is inconsistent with a protected application installation directory.

2. Automatic Execution Registration: The default installation registers TcSysUI.exe (the TwinCAT System User Interface) for automatic execution whenever a user logs into the Windows session. This is typically achieved through a Registry Run key (e.g., HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run or HKEY_LOCAL_MACHINE\...\Run), a Startup folder shortcut, or a Windows service. Because the binary resides in the world-writable C:\TwinCAT directory tree, any local user — regardless of their privilege level — can overwrite or replace this executable with arbitrary code.

The vulnerability class here is CWE-276: Incorrect Default Permissions (or closely related CWE-732: Incorrect Permission Assignment for Critical Resource). The attack mechanism is a binary planting or file replacement attack, sometimes referred to as an insecure file permission race. When a higher-privileged user (including an administrator) subsequently logs in, the Windows operating system executes the tampered TcSysUI.exe with the privileges of that user, thereby executing the attacker-controlled payload in a higher-privileged security context.

The attack does not require any network access or remote exploitation. It is purely a local attack vector, requiring the attacker to have a valid local account on the affected machine. In default Beckhoff IPC deployments, the system ships with TwinCAT installed and only one local user configured. The vulnerability becomes relevant when an administrator adds additional, less-privileged user accounts to the system — a common scenario in shared industrial environments.

From a coding and mechanism perspective, the flaw is not in the TwinCAT application code itself but in the installation routine and the Windows file system ACLs applied to the installation directory. No specific function names, API calls, or code-level implementation details beyond TcSysUI.exe and the directory path C:\TwinCAT are provided in the NVD description. The essential technical detail is that the directory creation logic does not restrict permissions to administrators or the SYSTEM account, and the auto-start registration does not verify the integrity of the binary before execution.

Exploitation Scenarios

Prerequisites:

• An affected Beckhoff TwinCAT XAR 3.1 installation located at C:\TwinCAT (default path).
• At least one additional local user account with less-than-administrative privileges (e.g., a standard Windows user).
• A second user account with higher privileges (standard user or administrator) that logs into the machine.

Attack Chain (inferred from the NVD description; no public PoC is confirmed):

Step 1 — Reconnaissance / Target Identification: The attacker identifies a Beckhoff IPC or engineering workstation running TwinCAT XAR 3.1 installed at C:\TwinCAT. The attacker must have already obtained a local account on the system with standard user privileges. Reconnaissance involves verifying that the C:\TwinCAT directory exists, that TcSysUI.exe is present, and that the directory permissions permit modification by their user account. This can be done through standard file system inspection.

Step 2 — Triggering the Vulnerability Class: The attacker inspects the Access Control Lists on C:\TwinCAT and its subdirectories. If the permissions allow write/modify for non-privileged users (as described in the advisory), the attacker can proceed. The vulnerability is triggered simply by the existence of the permissive DACL — no application-level bug or race condition needs to be exploited at this stage.

Step 3 — Payload Preparation / Execution: The attacker renames or copies the original TcSysUI.exe to a backup location, then places a malicious executable (e.g., a reverse shell, credential stealer, or persistence implant) at the same path C:\TwinCAT\TcSysUI.exe. Alternatively, the attacker may replace the entire file content with their payload. The payload must be crafted to appear as a valid Win32 executable. When the higher-privileged user (e.g., an administrator or even another standard user with access to sensitive resources) logs into the machine via the console, RDP, or Fast User Switching, Windows automatically executes TcSysUI.exe with the privileges of the logging-in user, triggering the attacker's payload to run with those elevated privileges.

Step 4 — Post-Exploitation Impact: Upon successful execution, the attacker gains code execution in the context of the logged-in user. If that user is an administrator, the attacker achieves full administrative access to the TwinCAT host, including the ability to modify PLC programs, access engineering databases, intercept industrial process data, disable safety functions, or pivot to other assets on the OT (Operational Technology) network. Even if the victim is a non-admin user, the attacker may gain access to secrets, certificates, or application data associated with that user's profile.

Note on PoC: No public proof-of-concept code is confirmed available at the time of this report. The attack chain above is inferred from the vulnerability class and the explicit technical details (default directory path, TcSysUI.exe, auto-execution upon login) provided in the NVD description. This is a local-only attack vector; it cannot be triggered remotely without prior compromise of a local account.

Impact Assessment

CVSS Score: 7.3 (High) — This reflects a high impact on confidentiality, integrity, and availability (CI:A/IC:N/AC:L). The attack requires local access (AV:L), low attack complexity (AC:L), no user interaction beyond normal login, and low privileges to exploit.

Business Impact: For organizations operating Beckhoff-based automation systems (packaging, material handling, printing, semiconductor, and custom machine building), this vulnerability poses a direct threat to the integrity of industrial control operations. A successful exploit could allow:

• Tampering with TwinCAT runtime configuration or PLC projects, potentially disrupting production lines.
• Exfiltration of proprietary intellectual property (machine designs, process parameters, recipes).
• Lateral movement into other OT and IT systems connected to the machine network.
• Ransomware deployment or destructive attacks targeting industrial controllers.

Affected Systems: All Beckhoff TwinCAT XAR 3.1 installations using the default C:\TwinCAT directory. Beckhoff IPCs shipped with this software and later provisioned with additional lower-privileged local users are the realistic affected population. Engineering workstations and virtualized TwinCAT environments are also susceptible.

Blast Radius: The attack is limited to a single host, but in OT environments where machines are grouped on flat networks, the compromise of one engineering station or IPC can often be leveraged to pivot to connected controllers (EtherCAT, PROFINET) and other automation assets. The use of administrative accounts for routine operations increases the severe impact of the escalation.

Detection Guidance

The following detection rules target the file system modification of TcSysUI.exe, the presence of new files in C:\TwinCAT, suspicious process creation originating from the TwinCAT directory, and behavioral patterns consistent with binary planting in world-writable directories.

Sigma Rule

title: Suspicious File Replacement in TwinCAT Directory
id: 1c3a5b6e-0001-4b3a-9c2a-3f1e2d3c4b5a
status: experimental
description: Detects attempts to replace or modify TcSysUI.exe in the default TwinCAT installation directory, indicating possible binary planting for privilege escalation (CVE-2020-12510).
author: Valtersit Threat Intel
date: 2025/01/01
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|startswith: 'C:\TwinCAT\'
        TargetFilename|endswith: '.exe'
    selection_file:
        TargetFilename|contains: 'TcSysUI'
    condition: selection_path and selection_file
level: high
falsepositives:
    - Legitimate TwinCAT updates or patches modifying binaries in C:\TwinCAT
    - Reinstallation of TwinCAT software
fields:
    - TargetFilename
    - User
    - ProcessId

YARA Rule

rule TwinCAT_Binary_Planting_Indicator
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects modified TwinCAT executable likely planted for privilege escalation (CVE-2020-12510)"
        reference = "CVE-2020-12510"
        date = "2025-01-01"
        severity = "high"
    strings:
        $orig_org = "TwinCAT" ascii wide nocase
        $orig_path = "C:\\TwinCAT" ascii wide nocase
        $malicious = "cmd.exe" ascii wide nocase
        $malicious2 = "powershell" ascii wide nocase
        $malicious3 = "CreateProcess" ascii wide nocase
        $malicious4 = "socket" ascii wide nocase
        $malicious5 = "WinExec" ascii wide nocase
        $susp_api = "LoadLibrary" ascii wide nocase
        $susp_api2 = "GetProcAddress" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and   // MZ header
        (1 of ($orig_*) and 3 of ($malicious*) or 1 of ($susp_api*) ) and
        filesize < 5MB
}

Note: The YARA rule targets suspicious characteristics in the replaced executable such as embedded system commands, network socket APIs, or dynamic library loading that deviate from the legitimate TwinCAT binary profile. Analysts should baseline legitimate TcSysUI.exe hashes for the environment.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2020-12510 TwinCAT Binary Download or SMB Transfer"; flow:to_server; content:"TcSysUI"; nocase; sid:2020125101; rev:1;)
alert smb any any -> any any (msg:"CVE-2020-12510 SMB Write to TwinCAT Directory"; content:"|ff 53 4d 42|"; depth:4; content:"C|5c|TwinCAT"; nocase; distance:0; sid:2020125102; rev:1;)

Note: Since CVE-2020-12510 is a purely local attack vector, network-level detection is limited. The above rules are heuristic indicators for remote file transfer or lateral movement involving the TwinCAT directory. Network detection is not a primary defense for this vulnerability.

Elastic Detection

// Detect process creation from the TwinCAT directory
process where event.action == "start" and process.executable : "C:\\TwinCAT\\*.exe"
    and not (process.code_signature.trusted == true or process.code_signature.subject_name : "*Beckhoff*")
// Detect file modification events targeting TcSysUI.exe
file where event.action in ("modification", "overwrite") and file.path : "C:\\TwinCAT\\TcSysUI.exe"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| search New_Process_Name="C:\\TwinCAT\\*.exe"
| where NOT (Process_Name="C:\\TwinCAT\\TcSysUI.exe" AND User="SYSTEM")
| table _time, User, New_Process_Name, CommandLine, Parent_Process_Name

index=windows sourcetype=WinEventLog:Security EventCode=4663
| search Object_Name="C:\\TwinCAT\\TcSysUI.exe" OR Object_Name="C:\\TwinCAT\\*"
| search Access_Mask="*WRITE*" OR Access_Mask="*DELETE*"
| where NOT User="NT AUTHORITY\\SYSTEM" AND NOT User="*ADMIN*"
| table _time, User, Object_Name, Access_Mask, Process_Name

Wazuh OSSEC Rule

<group name="windows,">
    <rule id="100512" level="12">
        <if_sid>550</if_sid>
        <field name="win.event.system.eventID">4663</field>
        <field name="win.event.data.objectName">C:\TwinCAT\TcSysUI.exe</field>
        <description>TwinCAT binary modification attempt detected - CVE-2020-12510 exploitation possible</description>
        <group>twinCAT_attack,</group>
    </rule>
    <rule id="100513" level="12">
        <if_sid>550</if_sid>
        <field name="win.event.system.eventID">4688</field>
        <field name="win.event.data.newProcessName">C:\TwinCAT\*.exe</field>
        <description>Process execution from TwinCAT directory - possible malicious binary</description>
        <group>twinCAT_attack,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source (CNA) claims patch; not independently confirmed.

1) Immediate Mitigations

• Restrict Local User Accounts: Audit all local accounts on Beckhoff IPCs and TwinCAT engineering workstations. Remove or disable any accounts that are not strictly required. Where multiple users are required, ensure each account uses a unique, strong password and is subject to least-privilege principles.
• Lock Down the TwinCAT Directory: Manually apply restrictive ACLs to C:\TwinCAT so that only the SYSTEM account, Administrators group, and the TwinCAT service accounts have read and execute permissions. Remove write permissions for Authenticated Users and Users groups on all files and subdirectories.
• Monitor Login Behavior: Implement real-time alerting for login events followed by process creation from C:\TwinCAT\TcSysUI.exe.

2) Patch / Upgrade Steps (per vendor advisory)

• Re-install TwinCAT to a Protected Path: Uninstall the existing TwinCAT 3.1 installation, then re-install it using the custom installation option, selecting C:\Program Files\TwinCAT as the installation directory. The Program Files directory on Windows enforces stricter default permissions that restrict modification to administrative users.
• Migrate Projects: Before re-installation, back up the complete device. Move any existing TwinCAT projects and configurations from C:\TwinCAT to the new installation path.
• Clean Up Old Path: After successful migration and validation, permanently delete all former content from C:\TwinCAT to eliminate any residual world-writable files and prevent re-exploitation.

3) Long-Term Hardening

• Enforce Standard Installation Paths: Establish an organizational policy requiring all TwinCAT and industrial software installations to use C:\Program Files\ or another administratively-controlled location.
• Apply the Principle of Least Privilege: Implement Tiered administration for OT assets. Ensure operators use standard user accounts, and administrators use separate elevated accounts with no automatic logon.
• Use Application Whitelisting: Deploy application control software (e.g., Windows AppLocker, Defender Application Control, or third-party CTI tools) to restrict execution to signed, known-good binaries only.
• Baseline & Monitor: Create file hash baselines for all TwinCAT binaries. Alert on any hash mismatch or unexpected modifications to TcSysUI.exe or other files in the installation directory.
• Audit Windows Logon Events: Enable detailed auditing for successful and failed logon events and monitor for Fast User Switching behavior that could trigger the vulnerable auto-execution path.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-12510
2. Beckhoff (CNA) Advisory: Available via CVE record — vendor-recommended fix to install TwinCAT to C:\Program Files\TwinCAT via custom installation; remove former C:\TwinCAT content post-migration.
3. CISA Known Exploited Vulnerabilities Catalog: Not listed (as of report date); no evidence of in-the-wild exploitation tracked.
4. EPSS Data: Score 0.00839 (54.6th percentile) — indicates low but non-zero probability of exploitation in the wild; vulnerability is not currently trending in active exploit campaigns per available threat intelligence.
5. Mitre CWE Mapping: Closest weakness classification is CWE-276: Incorrect Default Permissions (inferred from NVD description; not explicitly assigned).

Threat Actor Notes: As of this report, no specific threat actor campaigns, ransomware groups, or suspected nation-state activity have been publicly attributed to the exploitation of CVE-2020-12510. The attack is local-only, which lowers its attractiveness for remote campaign use, but it remains a viable vector in physical or supply-chain attack scenarios where an attacker already has a foothold on an OT host.