Vulnerability record · CVE-2011-3486 · published 16 September 2011
CVE-2011-3486: Beckhoff TwinCAT UDP request out-of-bounds read causes denial of service
Beckhoff · Twincat
Beckhoff TwinCAT 2.11.0.2004 and earlier performs an out-of-bounds read when handling a crafted request sent to UDP port 48899, which can crash or otherwise deny service. The flaw is remotely reachable without authentication, so any host that can send UDP packets to the port can trigger it.
Description
Beckhoff TwinCAT 2.11.0.2004 and earlier allows remote attackers to cause a denial of service via a crafted request to UDP port 48899, which triggers an out-of-bounds read.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityUnauthenticated remote denial of service on an industrial control product with a public exploit reference and very high EPSS, though no KEV listing or code execution.
What it is
Beckhoff TwinCAT 2.11.0.2004 and earlier performs an out-of-bounds read when handling a crafted request sent to UDP port 48899, which can crash or otherwise deny service. The flaw is remotely reachable without authentication, so any host that can send UDP packets to the port can trigger it.
Impact
An unauthenticated remote attacker can cause a denial of service on the affected TwinCAT system, disrupting control or engineering operations. The record describes only an out-of-bounds read, so no code execution or data disclosure is claimed.
Attack surface
Reached over the network via a crafted UDP packet to port 48899; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware use is documented, but EPSS is high (0.4965, 98.8th percentile) and a public exploit reference is tagged, so exploitation is plausible and likely.
What to do
- Upgrade TwinCAT to a version later than 2.11.0.2004, or apply the vendor fix referenced in the US-CERT ICS alert.
- Restrict network access to UDP port 48899 to trusted engineering hosts using firewall or ACL rules.
- Segment TwinCAT systems from general IT and untrusted networks to limit who can reach the port.
- Monitor and log traffic to UDP port 48899 for unexpected or malformed packets.
Detection
- Alert on unexpected or malformed UDP traffic to port 48899 from hosts outside the engineering network.
- Monitor TwinCAT service crashes, restarts or loss of availability and correlate with inbound UDP 48899 packets.
- Baseline which hosts legitimately communicate on UDP 48899 and flag new or anomalous sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-3486 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-3486), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
