{"id":"CVE-2026-18768","kind":"vulnerability","aliases":["CVE-2026-18768"],"related":[],"title":"Beckhoff TwinCAT 3 TcRouter.sys driver lets local low-privilege users access arbitrary physical memory","description":"A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.","summary":"Beckhoff's TcRouter.sys driver, installed by some TwinCAT 3 products for Windows, exposes IOCTL calls that let a local low-privileged user access arbitrary physical memory or define its mapping, leading to full compromise of the machine. Fixed in TcRouter.sys 3.1.0.2365. Sibling CVEs in the same advisory: CVE-2026-18767 (I/O ports), CVE-2026-18769 (moving physical memory).","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TcRouter.sys","fixed":["3.1.0.2365"],"affected":"< 3.1.0.2365","ecosystem":"vendor"},{"name":"TwinCAT.XAR.Base","fixed":["3.18.1"],"affected":"< 3.18.1","ecosystem":"vendor"},{"name":"TwinCAT 3 Build 4024 (ADS, XAR, XAE)","fixed":["3.1.4024.79"],"affected":"< 3.1.4024.79","ecosystem":"vendor"}],"ecosystems":[],"tags":["beckhoff","ics","infrastructure","kernel-driver","local-privilege","twincat","windows"],"not_affected_if":["no-tcrouter-driver","no-twincat-installed"],"how_to_check":"On Windows machines with TwinCAT 3 (ADS, XAR, XAE), check the file version of TcRouter.sys (usually under C:\\Windows\\System32\\drivers; right-click > Properties > Details). Below 3.1.0.2365 is vulnerable. Also check the TcPkg package TwinCAT.XAR.Base (< 3.18.1) or TwinCAT 3 Build 4024 (< 3.1.4024.79). Also check if you run TwinCAT 3 Build 4026 workloads (Standard Runtime/Engineering < 4026.25.0).","fix":"Update TwinCAT components: TcRouter.sys 3.1.0.2365 or later, TwinCAT.XAR.Base 3.18.1 or later, TwinCAT 3 Build 4024 3.1.4024.79 or later, TwinCAT Standard Runtime/Engineering 4026.25.0 or later. Beckhoff's text says only 'update to a recent version of the affected components'.","status":"open","published_at":"2026-11-11T09:17:15+00:00","first_seen_at":"2026-11-11T09:26:49+00:00","triaged_at":"2026-11-11T09:28:19+00:00","updated_at":"2026-11-11T09:30:07+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T09:28:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"TcRouter.sys driver lets local low-privilege users read arbitrary physical memory","impact":"high","summary":"TcRouter.sys exposes IOCTL calls that a local low-privileged user can invoke to access arbitrary physical memory or define memory mappings. An attacker who gets a local foothold can use this to fully compromise the affected device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel-driver"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains kernel-level physical memory access and full compromise","analyst_note":"Identify the vendor and product shipping TcRouter.sys and the fixed driver version from the NVD entry or vendor advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tcrouter-driver"],"who_is_affected":"Affects systems that have the TcRouter.sys driver installed and loaded; any local account with low privileges can reach the flawed IOCTL interface. The sources do not name the product that ships the driver, so whether a given machine runs it is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4516,"output_tokens":458,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and product shipping TcRouter.sys and the fixed driver version from the NVD entry or vendor advisory.","search":"'-18767':92B '-18768':18A,21A '-18769':97B '-2026':17A,20A,91B,96B '3':3A,25A,50B '3.1.0.2365':83B '4024':27A 'access':12A,65B,107C 'ads':28A 'advisori':89B 'affect':130C 'arbitrari':13A,66B,108C 'attack':105C 'beckhoff':1A,31B,42B 'build':26A 'call':56B,122C 'compromis':76B,127C 'cve':16A,19A,90B,95B 'cves':85B 'defin':70B,112C 'devic':131C 'driver':5A,36B,45B 'expos':54B,119C 'fix':80B 'full':75B,126C 'function':121C 'i/o':93B 'ic':32B 'infrastructur':33B 'instal':46B 'ioctl':55B,120C 'kernel':35B 'kernel-driv':34B 'lead':73B 'let':6A,58B 'local':7A,38B,60B,102C 'local-privileg':37B 'low':9A,62B,103C 'low-privileg':8A,61B 'machin':79B 'map':72B,114C 'memori':15A,68B,100B,110C 'move':98B 'physic':14A,67B,99B,109C 'port':94B 'privileg':10A,39B,63B,104C 'product':51B 'result':123C 'sibl':84B 'tcrouter.sys':4A,22A,44B,82B,116C 'twincat':2A,24A,40B,49B 'twincat.xar.base':23A 'user':11A,64B 'via':115C 'window':41B,53B 'xae':30A 'xar':29A","nicknames":[],"mitigations":[],"who_affected":"Windows machines with Beckhoff TwinCAT 3 (ADS, XAR, XAE Build 4024; Build 4026 via TwinCAT.XAR.Base) that install TcRouter.sys older than 3.1.0.2365. Any local low-privileged account can reach the driver's IOCTLs. Systems without TwinCAT, or already updated, can skip it. Beckhoff advises dedicating the PC to TwinCAT use and limiting access to trusted people.","tier":"B","verified":{"fix":{"at":"2026-11-11T09:30:07Z","by":"analyst","doc":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","run_id":3525},"products":{"at":"2026-11-11T09:30:07Z","by":"analyst","doc":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","run_id":3525},"how_to_check":{"at":"2026-11-11T09:30:07Z","by":"analyst","doc":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","run_id":3525},"who_affected":{"at":"2026-11-11T09:30:07Z","by":"analyst","doc":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","run_id":3525}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["3build4024adsxarxae","tcroutersys","twincat3build4024adsxarxae","twincatxarbase"],"ptokens":["4024","ads","base","build","sys","tcrouter","twincat","xae","xar"],"labels":["beckhoff","high","ics","infrastructure","kerneldriver","localprivilege","twincat","windows"],"campaign_type":null,"search_a":"'-18768':18A,21A '-2026':17A,20A '3':3A,25A '4024':27A 'access':12A 'ads':28A 'arbitrari':13A 'beckhoff':1A 'build':26A 'cve':16A,19A 'driver':5A 'let':6A 'local':7A 'low':9A 'low-privileg':8A 'memori':15A 'physic':14A 'privileg':10A 'tcrouter.sys':4A,22A 'twincat':2A,24A 'twincat.xar.base':23A 'user':11A 'xae':30A 'xar':29A","search_b":"'-18767':92B '-18769':97B '-2026':91B,96B '3':50B '3.1.0.2365':83B 'access':65B 'advisori':89B 'arbitrari':66B 'beckhoff':31B,42B 'call':56B 'compromis':76B 'cve':90B,95B 'cves':85B 'defin':70B 'driver':36B,45B 'expos':54B 'fix':80B 'full':75B 'i/o':93B 'ic':32B 'infrastructur':33B 'instal':46B 'ioctl':55B 'kernel':35B 'kernel-driv':34B 'lead':73B 'let':58B 'local':38B,60B 'local-privileg':37B 'low':62B 'low-privileg':61B 'machin':79B 'map':72B 'memori':68B,100B 'move':98B 'physic':67B,99B 'port':94B 'privileg':39B,63B 'product':51B 'sibl':84B 'tcrouter.sys':44B,82B 'twincat':40B,49B 'user':64B 'window':41B,53B","search_c":"'access':107C 'affect':130C 'arbitrari':108C 'attack':105C 'call':122C 'compromis':127C 'defin':112C 'devic':131C 'expos':119C 'full':126C 'function':121C 'ioctl':120C 'local':102C 'low':103C 'map':114C 'memori':110C 'physic':109C 'privileg':104C 'result':123C 'tcrouter.sys':116C 'via':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18768","severity":null,"published_at":"2026-11-11T09:17:15+00:00","modified_at":"2026-11-11T09:17:15+00:00","first_seen_at":"2026-11-11T09:26:49+00:00","fetched_at":"2026-11-11T09:26:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18768:3525","url":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","severity":null,"published_at":"2026-11-11T09:30:07+00:00","modified_at":"2026-11-11T09:30:07+00:00","first_seen_at":"2026-11-11T09:30:07+00:00","fetched_at":"2026-11-11T09:30:07+00:00","note":"Beckhoff advisory 2026-001 / VDE-2026-087 read; vendor, versions, fix thresholds confirmed. No exploitation or PoC for this CVE seen; LOLDrivers issue covers the older driver family. Beckhoff's mitigation is to dedicate the PC and restrict access (workaround, not a fix). Not searched on X.","cites":["https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","https://github.com/magicsword-io/LOLDrivers/issues/296"]}],"documents":[{"id":124353,"url":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","title":"Beckhoff Security Advisory 2026-001: Exposed IOCTLs in TcRouter.sys","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":124358,"url":"https://github.com/magicsword-io/LOLDrivers/issues/296","title":"LOLDrivers: TcIo.sys + TcRouter.sys (Beckhoff TwinCAT 3)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}