TcRouter.sys: Insufficient IOCTL access control allows I/O port access
Summary
Beckhoff TcRouter.sys, a Windows driver of the TwinCAT automation software, exposes IOCTL function calls with insufficient access control. A local attacker or process with low privileges can access I/O ports and thereby fully compromise the affected device. The CNA rates the issue CVSS 4.0 8.5 (High). No remote attack path is described.
Affected
- TcRouter.sys for Windows x64 and x86: 3.1.0.2364 and 1.0.0 to before 3.1.0.2365
- TwinCAT.XAR.Base.KM: 3.16.29 and 1.0.0 to before 3.18.1
Fixed in
- TcRouter.sys: 3.1.0.2365 or later
- TwinCAT.XAR.Base.KM: 3.18.1 or later
Workaround
Unknown. The vendor advisory is not verified; secondary trackers report no additional mitigation steps beyond the fix.
- Until patching: limit local logons on TwinCAT systems and restrict who can run code there.
Exploitation
- Not known to be exploited (OffSeq).
- No public proof of concept found.
- No CISA KEV entry found.
Our recommendation
- Identify all Windows PCs and industrial PCs running TwinCAT and confirm the TcRouter.sys and TwinCAT.XAR.Base.KM versions.
- Update to TcRouter.sys 3.1.0.2365 or later and TwinCAT.XAR.Base.KM 3.18.1 or later in the next maintenance window, after testing for TwinCAT compatibility.
- Until then, restrict local logons and remove unnecessary user access on these systems.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT@VDE advisory VDE-2026-087 www.certvde.com
- CVE Record CVE-2026-18767 www.cve.org
- VulDB entry 435705 vuldb.com
- OffSeq threat radar CVE-2026-18767 radar.offseq.com
- Threatint CVE-2026-18767 cve.threatint.com
- LOLDrivers entry for TcRouter.sys www.loldrivers.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:21.
Original description (NVD)
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.