CVE-2015-4051

EXPLOITED

Beckhoff IPC Diagnostics < 1.7 - Unauthenticated Denial of Service and Arbitrary User Creation via SOAP Action

Title source: llm

Exploitation Summary

CVE-2015-4051 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.

References (6)

Core 6

Core References

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/132168/Beckhoff-IPC-Diagnositcs-Authentication-Bypass.html

Vendor Advisory x_refsource_confirm

http://ftp.beckhoff.com/download/document/IndustPC/Advisory-2015-001.pdf

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/134071/Beckoff-CX9020-CPU-Model-Remote-Code-Execution.html

Exploit mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Jun/10

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/75042

Exploit x_refsource_misc

http://www.thesecurityfactory.be/permalink/beckhoff-authentication-bypass.html

Scores

EPSS 0.0573

EPSS Percentile 92.1%

Details

VulnCheck KEV 2020-12-01

CWE

CWE-284

Status published

Products (1)

beckhoff/ipc_diagnostics < 1.7

Published Jun 08, 2015

Tracked Since Feb 18, 2026