{"id":"CVE-2026-18769","kind":"vulnerability","aliases":["CVE-2026-18769"],"related":[],"title":"Beckhoff TwinCAT's TcRouter.sys driver lets low-privileged local users move physical memory","description":"A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.","summary":"Beckhoff's TcRouter.sys driver, installed by some TwinCAT products for Windows, exposes IOCTLs that let a local low-privileged user move arbitrary physical memory content, which Beckhoff says results in full compromise of the device. Part of Beckhoff advisory 2026-001 (VDE-2026-087) with CVE-2026-18767 and CVE-2026-18768.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TcRouter.sys","fixed":["3.1.0.2365"],"affected":"< 3.1.0.2365","ecosystem":"vendor"},{"name":"TwinCAT.XAR.Base","fixed":["3.18.1"],"affected":"< 3.18.1","ecosystem":"vendor"},{"name":"TwinCAT 3 Build 4024","fixed":["3.1.4024.79"],"affected":"< 3.1.4024.79","ecosystem":"vendor"},{"name":"TwinCAT 3 Build 4026 workloads","fixed":["4026.25.0"],"affected":"< 4026.25.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["beckhoff","ics","infrastructure","kernel-driver","local-privilege-escalation","twincat","windows"],"not_affected_if":["no-tcrouter-driver","no-twincat","no-untrusted-local-users","tcrouter-3.1.0.2365-or-later"],"how_to_check":"On Windows machines with TwinCAT, check the file version of TcRouter.sys (Properties > Details, or (Get-Item <path>\\TcRouter.sys).VersionInfo in PowerShell): below 3.1.0.2365 is affected. Also check the installed TcPkg package TwinCAT.XAR.Base (< 3.18.1), TwinCAT 3 Build 4024 (< 3.1.4024.79), or the Build 4026 Standard Runtime/Engineering workloads (< 4026.25.0).","fix":"Update the affected TwinCAT components so TcRouter.sys is 3.1.0.2365 or later: TwinCAT.XAR.Base 3.18.1, Build 4024 3.1.4024.79, Build 4026 workloads 4026.25.0 (fixed bounds from the Beckhoff advisory's affected-version table; its Solution text says only 'update to a recent version').","status":"open","published_at":"2026-11-11T09:17:15+00:00","first_seen_at":"2026-11-11T09:26:49+00:00","triaged_at":"2026-11-11T09:28:19+00:00","updated_at":"2026-11-11T09:30:05+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T09:28:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows TcRouter.sys driver lets local users read and move physical memory","impact":"high","summary":"TcRouter.sys is a Windows kernel driver that exposes IOCTL calls to user-mode code. A local attacker with low privileges can use them to move arbitrary physical memory, which the source says can lead to full compromise of the affected device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel-driver"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local low-privilege user gains full control of the device","analyst_note":"Find the vendor product that ships TcRouter.sys, the affected version ranges and any patch, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-18769.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tcrouter-driver","no-untrusted-local-users"],"who_is_affected":"Only machines where the TcRouter.sys driver is installed and loaded are in scope; the sources do not name the product that ships it. An attacker needs a local account on the machine, so systems with no untrusted local users are at lower risk. The sources do not say which versions are affected or which product owns the driver.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4515,"output_tokens":501,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor product that ships TcRouter.sys, the affected version ranges and any patch, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-18769.","search":"'-001':85B '-087':88B '-18767':92B '-18768':96B '-18769':17A,20A '-2026':16A,19A,87B,91B,95B '2026':84B '3':24A,28A '4024':26A '4026':30A 'advisori':83B 'affect':123C 'arbitrari':66B,104C 'attack':101C 'beckhoff':1A,32B,44B,71B,82B 'build':25A,29A 'call':115C 'compromis':76B,120C 'content':69B,107C 'cve':15A,18A,90B,94B 'devic':79B,124C 'driver':5A,37B,47B 'escal':41B 'expos':55B,112C 'full':75B,119C 'function':114C 'ic':33B 'infrastructur':34B 'instal':48B 'ioctl':56B,113C 'kernel':36B 'kernel-driv':35B 'let':6A,58B 'local':10A,39B,60B,98C 'local-privilege-escal':38B 'low':8A,62B,99C 'low-privileg':7A,61B 'memori':14A,68B,106C 'move':12A,65B,103C 'part':80B 'physic':13A,67B,105C 'privileg':9A,40B,63B,100C 'product':52B 'result':73B,116C 'say':72B 'tcrouter.sys':4A,21A,46B,109C 'twincat':2A,23A,27A,42B,51B 'twincat.xar.base':22A 'user':11A,64B 'vde':86B 'via':108C 'window':43B,54B 'workloads':31A","nicknames":[],"mitigations":[],"who_affected":"Windows PCs, engineering workstations and industrial PCs with TwinCAT 3 (ADS, XAR, XAE) installed, since these install TcRouter.sys. An attacker needs a local low-privileged account or process on the machine. Machines without TwinCAT, or where only trusted people have access, can skip it or are at lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-11T09:30:06Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-087/","run_id":3524},"products":{"at":"2026-11-11T09:30:06Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-087/","run_id":3524},"how_to_check":{"at":"2026-11-11T09:30:06Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-087/","run_id":3524},"who_affected":{"at":"2026-11-11T09:30:06Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-087/","run_id":3524}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["3build4024","3build4026workloads","tcroutersys","twincat3build4024","twincat3build4026workloads","twincatxarbase"],"ptokens":["4024","4026","base","build","sys","tcrouter","twincat","workloads","xar"],"labels":["beckhoff","high","ics","infrastructure","kerneldriver","localprivilegeescalation","twincat","windows"],"campaign_type":null,"search_a":"'-18769':17A,20A '-2026':16A,19A '3':24A,28A '4024':26A '4026':30A 'beckhoff':1A 'build':25A,29A 'cve':15A,18A 'driver':5A 'let':6A 'local':10A 'low':8A 'low-privileg':7A 'memori':14A 'move':12A 'physic':13A 'privileg':9A 'tcrouter.sys':4A,21A 'twincat':2A,23A,27A 'twincat.xar.base':22A 'user':11A 'workloads':31A","search_b":"'-001':85B '-087':88B '-18767':92B '-18768':96B '-2026':87B,91B,95B '2026':84B 'advisori':83B 'arbitrari':66B 'beckhoff':32B,44B,71B,82B 'compromis':76B 'content':69B 'cve':90B,94B 'devic':79B 'driver':37B,47B 'escal':41B 'expos':55B 'full':75B 'ic':33B 'infrastructur':34B 'instal':48B 'ioctl':56B 'kernel':36B 'kernel-driv':35B 'let':58B 'local':39B,60B 'local-privilege-escal':38B 'low':62B 'low-privileg':61B 'memori':68B 'move':65B 'part':80B 'physic':67B 'privileg':40B,63B 'product':52B 'result':73B 'say':72B 'tcrouter.sys':46B 'twincat':42B,51B 'user':64B 'vde':86B 'window':43B,54B","search_c":"'affect':123C 'arbitrari':104C 'attack':101C 'call':115C 'compromis':120C 'content':107C 'devic':124C 'expos':112C 'full':119C 'function':114C 'ioctl':113C 'local':98C 'low':99C 'memori':106C 'move':103C 'physic':105C 'privileg':100C 'result':116C 'tcrouter.sys':109C 'via':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18769","severity":null,"published_at":"2026-11-11T09:17:15+00:00","modified_at":"2026-11-11T09:17:15+00:00","first_seen_at":"2026-11-11T09:26:49+00:00","fetched_at":"2026-11-11T09:26:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18769:3524","url":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","severity":null,"published_at":"2026-11-11T09:30:05+00:00","modified_at":"2026-11-11T09:30:05+00:00","first_seen_at":"2026-11-11T09:30:05+00:00","fetched_at":"2026-11-11T09:30:05+00:00","note":"Read Beckhoff advisory 2026-001 / VDE-2026-087: vendor is Beckhoff TwinCAT; no exploitation mentioned. Advisory PDF has CVE-year typos (2025-). Workaround: dedicate the TwinCAT PC to trusted users. Check-script not written (needs file version of a binary).","cites":["https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","https://www.certvde.com/en/advisories/VDE-2026-087/"]}],"documents":[{"id":124353,"url":"https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf","title":"Beckhoff Security Advisory 2026-001: Exposed IOCTLs in TcRouter.sys","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":124356,"url":"https://www.certvde.com/en/advisories/VDE-2026-087/","title":"CERT@VDE VDE-2026-087: Beckhoff TcRouter.sys","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}