A critical deserialization flaw in Beckhoff TwinCAT 3 Engineering enables local command execution when a user opens a malicious project file, posing a significant risk to industrial workstations.

This vulnerability involves the insecure deserialization of untrusted data (CWE-502). An attacker can trigger arbitrary command execution in the context of the local user by tricking them into opening a specially crafted project file.

The exploitation of this vulnerability could lead to a full compromise of the affected engineering workstation, resulting in unauthorized data access, modification of industrial control logic, or total system loss. Given the CVSS score of 7.8, the impact is considered High because it allows an attacker to gain the same execution privileges as the authenticated user, potentially disrupting critical operational technology environments.

Immediate Action: Update the Beckhoff TwinCAT 3 Engineering software to version 3.1.4024.67 or later to implement the necessary deserialization security controls.

Proactive Monitoring: Monitor engineering workstation logs for suspicious file execution patterns or unexpected child processes spawned by the TwinCAT application.

Compensating Controls: Restrict the ability of users to open project files from untrusted sources and employ application whitelisting to prevent the execution of unauthorized binaries triggered by the software.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Beckhoff TwinCAT 3 Engineering should prioritize patching this vulnerability immediately. Because the attack vector relies on user interaction, security teams should also reinforce user training regarding the dangers of opening project files from unverified or untrusted sources to minimize the risk of successful exploitation.