CVE-2025-41727: Beckhoff Automation Beckhoff.device.manager.xar

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.

Affected products

• Beckhoff Automation Beckhoff.device.manager.xar: from 0.0.0, before 2.5.3 (fixed in 2.5.3)
• Beckhoff Automation Mdp For Beckhoff Rt Linuxr: from 0.0.0, before 0.0.5 (fixed in 0.0.5)
• Beckhoff Automation Mdp Software Package For Twincat/bsd: from 0.0.0, before 1.7.0.0 (fixed in 1.7.0.0)

Published 2026-01-27. Last modified 2026-06-17.