{"id":"CVE-2026-18767","kind":"vulnerability","aliases":["CVE-2026-18767"],"related":[],"title":"Beckhoff TwinCAT TcRouter.sys driver lets local low-privileged users access I/O ports","description":"A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.","summary":"Beckhoff advisory 2026-001 (VDE-2026-087): affected TcRouter.sys versions expose IOCTLs that let a local low-privileged user or process access I/O ports, leading to full compromise of the device. Sibling CVE-2026-18768 (physical memory access) and CVE-2026-18769 (physical memory move) are in the same advisory. Affected: Windows PCs and industrial controllers running Beckhoff TwinCAT 3 (ADS, XAR, XAE) that install TcRouter.sys below 3.1.0.2365. An attacker needs a local foothold as a low-privileged user. Machines without TwinCAT can skip it.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TcRouter.sys","fixed":["3.1.0.2365"],"affected":"< 3.1.0.2365","ecosystem":"vendor"},{"name":"TwinCAT.XAR.Base","fixed":["3.18.1"],"affected":"< 3.18.1","ecosystem":"vendor"},{"name":"TwinCAT 3 Build 4024","fixed":["3.1.4024.79"],"affected":"< 3.1.4024.79","ecosystem":"vendor"}],"ecosystems":[],"tags":["beckhoff","ics","infrastructure","kernel-driver","local","tcrouter-sys","twincat","windows"],"not_affected_if":["driver-not-installed","no-twincat","patched-driver"],"how_to_check":"On Windows machines with TwinCAT installed, check the file version of TcRouter.sys: versions below 3.1.0.2365 are affected. Also check the TcPkg package TwinCAT.XAR.Base (< 3.18.1) or TwinCAT 3 Build 4024 (< 3.1.4024.79).","fix":"Update to TcRouter.sys 3.1.0.2365 or later, via TwinCAT.XAR.Base 3.18.1 or later (Build 4026) or TwinCAT 3 Build 4024 version 3.1.4024.79 or later. Beckhoff's text says only: update to a recent version of the affected components.","status":"open","published_at":"2026-11-11T09:17:15+00:00","first_seen_at":"2026-11-11T09:26:49+00:00","triaged_at":"2026-11-11T09:28:18+00:00","updated_at":"2026-11-11T09:30:02+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-11T09:28:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows TcRouter.sys driver exposes I/O ports to local low-privilege users","impact":"high","summary":"TcRouter.sys, a Windows kernel driver, exposes IOCTL functions that let a local low-privileged process access I/O ports. An attacker who already has a local foothold can use this to fully compromise the affected device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","tcrouter-sys"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains full control of the affected device","analyst_note":"Identify the vendor and affected driver versions for TcRouter.sys and find the fixed build from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-18767.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["driver-not-installed"],"who_is_affected":"Only machines where the TcRouter.sys driver is installed are exposed, and the attacker must already be running code locally. The sources do not name the affected products or versions, so teams should first confirm whether the driver is present on their Windows systems.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4510,"output_tokens":466,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and affected driver versions for TcRouter.sys and find the fixed build from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-18767.","search":"'-001':41B '-087':44B '-18767':16A,19A '-18768':73B '-18769':80B '-2026':15A,18A,43B,72B,79B '2026':40B '3':23A,98B '3.1.0.2365':106B '4024':25A 'access':11A,60B,76B,132C 'ad':99B 'advisori':39B,88B 'affect':45B,89B,150C 'attack':108B,128C 'beckhoff':1A,26B,38B,96B 'build':24A 'call':142C 'compromis':66B,147C 'control':94B 'cve':14A,17A,71B,78B 'devic':69B,151C 'driver':4A,31B 'expos':48B,139C 'foothold':112B 'full':65B,146C 'function':141C 'i/o':12A,61B,133C 'ic':27B 'industri':93B 'infrastructur':28B 'instal':103B 'ioctl':49B,140C 'kernel':30B 'kernel-driv':29B 'lead':63B 'let':5A,51B 'local':6A,32B,53B,111B,125C 'low':8A,55B,116B,126C 'low-privileg':7A,54B,115B 'machin':119B 'memori':75B,82B 'move':83B 'need':109B 'pcs':91B 'physic':74B,81B 'port':13A,62B,134C 'privileg':9A,56B,117B,127C 'process':59B,130C 'result':143C 'run':95B 'sibl':70B 'skip':123B 'sys':35B 'tcrouter':34B 'tcrouter-si':33B 'tcrouter.sys':3A,20A,46B,104B,136C 'twincat':2A,22A,36B,97B,121B 'twincat.xar.base':21A 'user':10A,57B,118B 'vde':42B 'version':47B 'via':135C 'window':37B,90B 'without':120B 'xae':101B 'xar':100B","nicknames":[],"mitigations":[],"who_affected":"Only machines where the TcRouter.sys driver is installed are exposed, and the attacker must already be running code locally. The sources do not name the affected products or versions, so teams should first confirm whether the driver is present on their Windows systems.","tier":"B","verified":{"fix":{"at":"2026-11-11T09:30:02Z","by":"analyst","doc":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","run_id":3526},"products":{"at":"2026-11-11T09:30:02Z","by":"analyst","doc":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","run_id":3526},"how_to_check":{"at":"2026-11-11T09:30:02Z","by":"analyst","doc":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","run_id":3526}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["3build4024","tcroutersys","twincat3build4024","twincatxarbase"],"ptokens":["4024","base","build","sys","tcrouter","twincat","xar"],"labels":["beckhoff","high","ics","infrastructure","kerneldriver","local","tcroutersys","twincat","windows"],"campaign_type":null,"search_a":"'-18767':16A,19A '-2026':15A,18A '3':23A '4024':25A 'access':11A 'beckhoff':1A 'build':24A 'cve':14A,17A 'driver':4A 'i/o':12A 'let':5A 'local':6A 'low':8A 'low-privileg':7A 'port':13A 'privileg':9A 'tcrouter.sys':3A,20A 'twincat':2A,22A 'twincat.xar.base':21A 'user':10A","search_b":"'-001':41B '-087':44B '-18768':73B '-18769':80B '-2026':43B,72B,79B '2026':40B '3':98B '3.1.0.2365':106B 'access':60B,76B 'ad':99B 'advisori':39B,88B 'affect':45B,89B 'attack':108B 'beckhoff':26B,38B,96B 'compromis':66B 'control':94B 'cve':71B,78B 'devic':69B 'driver':31B 'expos':48B 'foothold':112B 'full':65B 'i/o':61B 'ic':27B 'industri':93B 'infrastructur':28B 'instal':103B 'ioctl':49B 'kernel':30B 'kernel-driv':29B 'lead':63B 'let':51B 'local':32B,53B,111B 'low':55B,116B 'low-privileg':54B,115B 'machin':119B 'memori':75B,82B 'move':83B 'need':109B 'pcs':91B 'physic':74B,81B 'port':62B 'privileg':56B,117B 'process':59B 'run':95B 'sibl':70B 'skip':123B 'sys':35B 'tcrouter':34B 'tcrouter-si':33B 'tcrouter.sys':46B,104B 'twincat':36B,97B,121B 'user':57B,118B 'vde':42B 'version':47B 'window':37B,90B 'without':120B 'xae':101B 'xar':100B","search_c":"'access':132C 'affect':150C 'attack':128C 'call':142C 'compromis':147C 'devic':151C 'expos':139C 'full':146C 'function':141C 'i/o':133C 'ioctl':140C 'local':125C 'low':126C 'port':134C 'privileg':127C 'process':130C 'result':143C 'tcrouter.sys':136C 'via':135C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18767","severity":null,"published_at":"2026-11-11T09:17:15+00:00","modified_at":"2026-11-11T09:17:15+00:00","first_seen_at":"2026-11-11T09:26:49+00:00","fetched_at":"2026-11-11T09:26:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18767:3526","url":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","severity":null,"published_at":"2026-11-11T09:30:02+00:00","modified_at":"2026-11-11T09:30:02+00:00","first_seen_at":"2026-11-11T09:30:02+00:00","fetched_at":"2026-11-11T09:30:02+00:00","note":"Beckhoff advisory 2026-001 read; vendor, versions and fix confirmed. No exploitation or PoC for these CVEs seen (LOLDrivers entry describes the driver generally). No social search done; no repo-readable check written (file version on host).","cites":["https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","https://www.loldrivers.io/drivers/12998ebb-8c74-4e44-89a2-2a71c0f6e92b/"]}],"documents":[{"id":124353,"url":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","title":"Beckhoff Security Advisory 2026-001: Exposed IOCTLs in TcRouter.sys","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":124354,"url":"https://www.loldrivers.io/drivers/12998ebb-8c74-4e44-89a2-2a71c0f6e92b/","title":"LOLDrivers: TcIo.sys and TcRouter.sys","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}