Dashboard / CVE-2026-18767

CVE-2026-18767

HIGH
MEDIUM Priority: 0.01 BB Relevance: 42/100
Published: 2026-11-11 Modified: 2026-11-12 First seen: 2026-11-11 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

Weakness Classification (1)

Affected Software (12)

VendorProductVersion
Beckhoff Automation TcRouter.sys for Windows on x64 3.1.0.2364 3.1.0.2364
Beckhoff Automation TcRouter.sys for Windows on x64 3.1.0.2364 3.1.0.2364
Beckhoff Automation TcRouter.sys for Windows on x64 <3.1.0.2365 1.0.0 < 3.1.0.2365
Beckhoff Automation TcRouter.sys for Windows on x64 <3.1.0.2365 1.0.0 < 3.1.0.2365
Beckhoff Automation TcRouter.sys for Windows on x86 3.1.0.2364 3.1.0.2364
Beckhoff Automation TcRouter.sys for Windows on x86 3.1.0.2364 3.1.0.2364
Beckhoff Automation TcRouter.sys for Windows on x86 <3.1.0.2365 1.0.0 < 3.1.0.2365
Beckhoff Automation TcRouter.sys for Windows on x86 <3.1.0.2365 1.0.0 < 3.1.0.2365
Beckhoff Automation TwinCAT.XAR.Base.KM 3.16.29 3.16.29
Beckhoff Automation TwinCAT.XAR.Base.KM 3.16.29 3.16.29
Beckhoff Automation TwinCAT.XAR.Base.KM <3.18.1 1.0.0 < 3.18.1
Beckhoff Automation TwinCAT.XAR.Base.KM <3.18.1 1.0.0 < 3.18.1

References & Advisories (1)

Bug Bounty Relevance

42 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

8.5 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.14%
Raw Score 0.001440
Percentile 3.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00144
2026-11-12
0.00144

Intelligence Sources

mitre ref →
nvd ref →

External Links