CVE-2025-41701

Executive Summary

CVE-2025-41701 is an unauthenticated deserialization-of-untrusted-data vulnerability in Beckhoff TwinCAT 3 Engineering software. An attacker can execute arbitrary commands in the context of a local user by tricking that user into opening a deliberately manipulated project file. The vulnerability carries a CVSS score of 7.8 (High) and is currently unpatched, with no vendor advisory or patch evidence available from any tracked source. Given TwinCAT 3's widespread use in industrial automation and ICS/SCADA environments, successful exploitation could lead to full system compromise of engineering workstations, which often possess elevated privileges and network access to programmable logic controllers (PLCs).

Technical Analysis

The vulnerability class is deserialization of untrusted data (CWE-77, Command Injection — while the CWE identifier maps to command injection, the CNA title explicitly identifies the root cause as deserialization of untrusted data). The attack mechanism involves a malicious project file that, when parsed and deserialized by the TwinCAT 3 Engineering tool, results in the execution of arbitrary commands on the host system.

From a technical standpoint, deserialization vulnerabilities arise when an application reconstructs objects from serialized input without sufficient validation. In this case, the TwinCAT 3 Engineering application — which is used to configure, program, and maintain Beckhoff PLCs — reads project files containing serialized objects. A crafted file can embed payloads that, during the deserialization process, trigger command execution via native OS system calls.

Attack surface details:

• Local attack vector — The attacker must convince a local user to open the malicious file using the affected engineering tool.
• No authentication required — The vulnerability can be triggered without any prior authentication against the target system.
• User interaction required — The victim must open the file, which is typical of phishing-style attacks targeting engineering personnel.
• Privilege context — Commands execute in the context of the logged-in user. In industrial engineering environments, this often means the user has administrative rights on the workstation and may have network credentials for PLC access.

Insufficient technical detail available: The NVD description does not specify the exact deserialization mechanism, the affected TwinCAT 3 product modules (e.g., XAE, XAR, or specific add-ons), or the file format extensions involved. No code-level details such as function names, object class names, or API endpoints are provided. The attack mechanism must therefore be described at the vulnerability-class level.

Exploitation Scenarios

The attack chain for CVE-2025-41701 follows a client-side exploitation pattern:

Step 1: Reconnaissance and Target Identification The attacker identifies organizations using Beckhoff automation equipment. This can be accomplished through:

• Shodan/Censys searches for TwinCAT services exposed to the internet (though exploitation is local, identifying organizations that use TwinCAT helps the attacker direct phishing campaigns).
• Open-source intelligence (OSINT) gathering from job postings, technical forums, and LinkedIn profiles of automation engineers.
• Industrial control system (ICS) asset inventories that publicly disclose Beckhoff PLC usage.

Step 2: Triggering the Vulnerability The attacker crafts a malicious TwinCAT 3 project file (the specific file extension format is not disclosed in available data — the attack is described at the file-class level). This file is designed such that when deserialized by the engineering tool, it triggers arbitrary command execution.

Delivery methods include:

• Email phishing with the malicious project file attached, targeting automation engineers, controls engineers, or maintenance personnel.
• Malicious file hosted on file-sharing platforms, engineering forums, or compromised vendor support portals.
• USB drop attacks in industrial facilities where the file is planted on a shared engineering workstation.

Step 3: Payload Execution Upon opening the file, the TwinCAT 3 Engineering tool deserializes the embedded data. The crafted payload causes the application to invoke operating system commands (e.g., via system(), ShellExecute, or similar execution methods at the OS level — the exact method is not disclosed in the CVE description). Arbitrary commands execute in the user's security context.

Post-Exploitation Impact:

• Full user-context compromise — The attacker gains code execution on the engineering workstation.
• Credential harvesting — Engineering workstations often store project credentials, connection profiles for PLCs, and potentially domain credentials.
• PLC manipulation — If the workstation has active connections to Beckhoff PLCs (CX series controllers, TwinCAT runtime systems), the attacker could push malicious logic to production controllers, potentially causing physical damage or production disruption.
• Pivot into OT network — Engineering workstations commonly sit on a network segment with broad access to industrial control devices; the attacker can pivot to scan and exploit other OT assets.

Exploitation notes:

• No public PoC or exploit code is available in tracked sources; the attack chain is inferred from the vulnerability class.
• EPSS score of 0.00166 (6.2% percentile) indicates low current exploitation likelihood, but this may change once technical details about the file format are publicly disclosed.

Impact Assessment

CVSS Breakdown (derived from vector):

• Attack Vector: Local (AV:L) — The attacker must have access to the local system or convince a user to interact locally.
• Attack Complexity: Low (AC:L) — No special conditions are required for successful exploitation.
• Privileges Required: None (PR:N) — Attack can be executed without authentication.
• User Interaction: Required (UI:R) — Victim must open the malicious project file.
• Confidentiality Impact: High (C:H) — Arbitrary commands can exfiltrate project data, credentials, and other sensitive engineering information.
• Integrity Impact: High (I:H) — Commands can modify or delete project files, alter system configurations, or push malicious code to connected PLCs.
• Availability Impact: High (A:H) — Ransomware or destructive commands could make engineering workstations and potentially connected automation systems unavailable.

Business Impact:

• Operational downtime — Compromised engineering workstations can halt commissioning, maintenance, and modification activities for Beckhoff-based production lines.
• Safety risk — In industrial environments, unauthorized modifications to PLC control logic can create unsafe operating conditions for machinery and personnel.
• Intellectual property theft — TwinCAT projects contain proprietary control logic, process parameters, and manufacturing know-how.
• Regulatory exposure — For organizations operating under NERC CIP, IEC 62443, or other ICS security frameworks, a demonstrated compromise of engineering systems may constitute a reportable incident.

Blast Radius: The vulnerability affects:

• TwinCAT 3 Engineering workstations and their users.
• Connected Beckhoff control systems (CX series, IPC, embedded PCs) that may be manipulated post-exploitation.
• The broader OT network that the engineering workstation can access.
• Enterprise network segments, if the engineering workstation is dual-homed or domain-joined.

Detection Guidance

The following detection rules are designed to identify potential exploitation attempts targeting CVE-2025-41701. These rules focus on anomalous process execution from engineering applications, suspicious child process creation, and file-based indicators of malicious TwinCAT project files.

Sigma Rule

title: Suspicious Child Process from TwinCAT 3 Engineering Tool
id: c2e4b1a8-3f5d-4c6e-9a1b-7d8e9f0a1b2c
status: experimental
description: Detects execution of suspicious child processes spawned by TwinCAT 3 Engineering applications, potentially indicating deserialization-based command injection (CVE-2025-41701)
author: Valtersit Threat Intel
date: 2025-01-01
tags:
    - attack.execution
    - attack.t1203
    - cve.2025-41701
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\TcXaeShell.exe'
            - '\TwinCAT Engineering.exe'
            - '\VisualStudio.exe'
    selection_suspicious_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
        CommandLine|contains:
            - '-enc'
            - '-e '
            - 'IEX'
            - 'downloadstring'
            - 'Invoke-'
            - 'calc.exe'
            - 'whoami'
            - 'net user'
    condition: selection_parent and selection_suspicious_child
falsepositives:
    - Legitimate automation scripts invoked by engineers during normal operations
level: high

YARA Rule

rule Beckhoff_TwinCAT3_CVE_2025_41701_Deserialization_Indicator
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects binary patterns commonly associated with deserialization payloads in TwinCAT 3 project files targeting CVE-2025-41701"
        reference = "CVE-2025-41701"
        date = "2025-01-01"
        severity = "high"
        cve = "CVE-2025-41701"
    strings:
        $cmd_exec_1 = "cmd.exe /c" ascii wide
        $cmd_exec_2 = "powershell" ascii wide nocase
        $cmd_exec_3 = "System.Diagnostics.Process" ascii wide
        $cmd_exec_4 = "ProcessStartInfo" ascii wide
        $deser_1 = "BinaryFormatter" ascii wide
        $deser_2 = "ObjectDataProvider" ascii wide
        $deser_3 = "Deserialize" ascii wide
        $project_marker_1 = "TcProject" ascii wide
        $project_marker_2 = "TwinCAT Project" ascii wide
        $shell_1 = "ShellExecute" ascii wide
        $shell_2 = "CreateProcess" ascii wide
        $encoded_cmd = "$env:" ascii wide nocase
    condition:
        uint16(0) == 0x4D5A and  // MZ header for PE files
        (2 of ($cmd_exec_*) or 2 of ($deser_*)) and
        (1 of ($project_marker_*)) or
        ($encoded_cmd and 1 of ($cmd_exec_*)) and
        (1 of ($shell_*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-41701 Potential TwinCAT 3 Malicious Project File Download"; flow:established,to_client; file.http; content:"---BOUNDARY"; nocase; fileext:"tsproj"; fileext:"tszip"; fileext:"zip"; content:"mshta"; nocase; sid:20254170101; rev:1; classtype:attempted-user; reference:cve,2025-41701;)

alert smb any any -> any any (msg:"CVE-2025-41701 TwinCAT 3 Project File with PowerShell Command Over SMB"; flow:established,to_client; content:"|ff fe|70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c|"; nocase; fileext:"tsproj"; fileext:"zip"; sid:20254170102; rev:1; classtype:attempted-user; reference:cve,2025-41701;)

alert smtp any any -> any any (msg:"CVE-2025-41701 Malicious Attachment Attempt via SMTP"; flow:established,to_client; content:"filename="; content:".tsproj"; nocase; content:"powershell"; nocase; sid:20254170103; rev:1; classtype:attempted-user; reference:cve,2025-41701;)

Elastic Detection

detection-1:
  description: "Process execution from TwinCAT Engineering tool with suspicious child processes"
  query: |
    process where event.action == "start" and 
    process.parent.name in ("TcXaeShell.exe", "TwinCAT Engineering.exe", "VisualStudio.exe") and
    process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe") and
    process.command_line matches "(?i)(-enc|-e |IEX|downloadstring|Invoke-|whoami|net user|calc.exe)"
    
detection-2:
  description: "File creation of TwinCAT project files on engineering systems outside expected paths"
  query: |
    file where event.action == "creation" and
    (file.extension == "tsproj" or file.extension == "tszip" or file.extension == "zip") and
    not file.path startswith "C:\\Users\\" and
    process.name in ("outlook.exe", "browser.exe", "winrar.exe", "7z.exe", "explorer.exe")
    
detection-3:
  description: "Command line activity immediately following TwinCAT Engineering process start"
  query: |
    sequence by host.id, process.parent.pid with maxspan=5m
    [ process where event.action == "start" and process.name in ("TcXaeShell.exe", "TwinCAT Engineering.exe") ]
    [ process where event.action == "start" and process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe") ]

Splunk SPL Query

(index=windows OR index=sysmon) sourcetype="WinEventLog:Security" OR sourcetype="XmlWinEventLog"
| search EventCode=4688
| eval ParentProcess = mvindex(Process_Command_Line, 0)
| where match(ParentProcess, "(?i)(TcXaeShell|TwinCAT Engineering|VisualStudio)")
| where match(CommandLine, "(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil)")
| table _time, User, Computer, ParentProcess, CommandLine, Host_Name, Source_Network_Address
| sort - _time

(index=filesystem index=endpoint) sourcetype=filesystem_monitor OR sourcetype=sysmon
| where match(FilePath, "(?i)(tsproj|tszip)") 
| search NOT FilePath="C:\\ProgramData\\Beckhoff\\*" 
| table _time, host, User, FilePath, ProcessName
| sort -_time

(index=windows) sourcetype=WinEventLog:Security 
| search EventCode=4688 
| rename New_Process_Name as ChildProcess, Process_Command_Line as CmdLine
| search ParentImage IN ("*TcXaeShell.exe", "*TwinCAT Engineering.exe", "*VisualStudio.exe")
| search ChildProcess IN ("*cmd.exe", "*powershell.exe", "*wscript.exe", "*cscript.exe", "*mshta.exe")
| eval suspicious = if(match(CmdLine, "(?i)(-enc|-e |IEX|downloadstring|Invoke-|whoami)"), "HIGH", "MEDIUM")
| where suspicious="HIGH"
| eval timestamp = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table timestamp, host, User, ParentImage, ChildProcess, CmdLine, suspicious

Wazuh OSSEC Rule

<group name="beckhoff,ics,deserialization,">

    <!-- CVE-2025-41701: Detect suspicious process launch from TwinCAT Engineering tools -->
    <rule id="986269" level="12">
        <if_sid>550</if_sid>
        <field name="win.event.type">1</field>
        <field name="win.eventdata.parentImage" type="pcre2">(?i)(TcXaeShell\.exe|TwinCAT Engineering\.exe|VisualStudio\.exe)</field>
        <field name="win.eventdata.image" type="pcre2">(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe)</field>
        <description>Potential CVE-2025-41701 exploitation: Suspicious child process (%%win.eventdata.image%%) spawned from TwinCAT Engineering tool (%%win.eventdata.parentImage%%)</description>
        <mitre>
            <id>T1203</id>
        </mitre>
        <group>process_creation,sysmon,sysmon_event_1,</group>
        <var name="command.line.regex">(?i)(-enc|-e |IEX|downloadstring|Invoke-|whoami|net user|calc\.exe|wscript|cscript)</var>
        <match>%%command.line.regex%%</match>
    </rule>

    <!-- CVE-2025-41701: Detect addition of Winlogon/registry run keys from TwinCAT processes -->
    <rule id="986270" level="10">
        <if_sid>550</if_sid>
        <field name="win.event.type">1</field>
        <field name="win.eventdata.parentImage" type="pcre2">(?i)(TcXaeShell\.exe|TwinCAT Engineering\.exe|VisualStudio\.exe)</field>
        <description>Potential CVE-2025-41701 persistence: TwinCAT Engineering process (%%win.eventdata.parentImage%%) modifying registry for persistence</description>
        <group>sysmon,sysmon_event_13,</group>
    </rule>

</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (0/4 patch confidence)

No vendor patch, security update, or fix is currently available from Beckhoff or any other tracked source. The CVE is marked as unpatched, and no affected version ranges have been published, meaning it is unclear which TwinCAT 3 versions are vulnerable.

Immediate Mitigations (compensating controls):

1. Restrict file opening — Configure Windows Group Policy or enterprise security software to block opening .tsproj, .tszip, and other TwinCAT project file types from untrusted sources (email, downloads, external drives).
2. Implement application whitelisting — Use AppLocker or Windows Defender Application Control (WDAC) to prevent child processes such as cmd.exe, powershell.exe, wscript.exe, and cscript.exe from being spawned by the TwinCAT Engineering executables.
3. Increase user awareness — Educate engineering personnel about phishing risks specifically targeting their roles, including delivery of malicious project files through email or engineering forums.
4. Monitor engineering workstations — Enable verbose process auditing (Event ID 4688 with command line capture) on all systems running TwinCAT 3 Engineering, and forward logs to a SIEM for analysis.
5. Restrict administrative privileges — Ensure engineering workstations run with least-privilege user accounts, not local administrator or domain admin credentials.
6. Network segmentation — Isolate engineering workstations on a separate VLAN with restrictive firewall rules limiting outbound internet access and lateral movement to OT assets.

Patch/Upgrade Steps:

• Monitor Beckhoff's official security advisories (https://www.beckhoff.com/en-en/support/download-finder) for a fix for CVE-2025-41701.
• Subscribe to Beckhoff's security notification service and the CISA ICS-CERT advisory mailing list.
• When a patch is released, prioritize deployment based on asset criticality, starting with engineering workstations that have network access to production PLCs.

Long-Term Hardening:

• Implement a robust patch management lifecycle for all TwinCAT components and the host operating system.
• Deploy a secure file transfer and validation mechanism for project files shared between engineers (e.g., hash verification, digital signatures where possible).
• Integrate OT-specific security monitoring (e.g., Nozomi, Dragos, Claroty) to detect anomalous behavior on engineering workstations and their interaction with PLCs.
• Conduct regular security assessments and penetration testing of the engineering environment, specifically testing file ingestion paths.
• Maintain incident response playbooks that address OT workstation compromise scenarios, including isolation procedures for affected systems and forensic preservation of malicious project files.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-41701 — Official NVD record with CVE description, CVSS vector (7.8), and CWE classification (CWE-77).
2. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2025-41701 is not listed in the KEV catalog at the time of writing, indicating no confirmed in-the-wild exploitation.
3. Beckhoff Automation Security Page: https://www.beckhoff.com/en-en/company/security/ — Vendor security information portal; no advisory published for CVE-2025-41701 as of the report date.
4. MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2025-41701 — CVE record containing the CNA title ("Beckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering") and original vendor disclosure details.
5. CWE-77 Command Injection Reference: https://cwe.mitre.org/data/definitions/77.html — CWE entry describing command injection, relevant for understanding the vulnerability's impact class.

Threat Actor Activity: No publicly documented threat actor campaigns, ransomware group activity, or exploit-in-the-wild evidence is associated with CVE-2025-41701 as of the report date. The EPSS score of 0.00166 (6.2% percentile) indicates that the vulnerability is not currently a common exploitation target. However, the lack of public exploit code does not preclude the existence of private exploitation or the availability of weaponized payloads on underground forums.