Plan ahead Medium Check your exposure
Beckhoff TcRouter.sys flaws let local users gain full system access
CERT@VDE advisoriesBeckhoff, TcRouter.sys
What happened. CERT@VDE advisory VDE-2026-087 says exposed input/output control (IOCTL) calls in Beckhoff's TcRouter.sys have weak access control. Local low-privileged users or processes can gain full system access on affected devices.
Who is affected. Users of Beckhoff devices that run TcRouter.sys. The source does not list versions.
What to do. Check whether your Beckhoff devices run TcRouter.sys and follow the VDE-2026-087 advisory for fixes.
When to act. Plan ahead: Beckhoff controller owners: review who holds local access; no exploitation is reported.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
- L1
Why: Beckhoff devices running TcRouter.sys are control and engineering systems, which sit at the controller and HMI levels.
- Are you exposed?
Search your Beckhoff devices for the TcRouter.sys driver and compare against advisory VDE-2026-087.
- If you cannot fix it yet
- Limit local and remote logon rights on affected Beckhoff devices to trusted administrators.
- Allowlist applications on affected devices so untrusted code cannot run.
- Watch for
- New or unexpected processes started by low-privileged accounts on devices running TcRouter.sys.
- Unexpected privilege changes on Beckhoff devices.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.