Beckhoff SBOM: getting EtherCAT terminals and the IPC into the device list
In brief · As of October 2026
A Beckhoff plant is an industrial PC with TwinCAT and a chain of EtherCAT couplers, terminals and drives. From the maintenance PC a scan sees only the IPC: the terminals have no IP address, their identity is read by the EtherCAT master alone. They get into the device list through the TwinCAT project, through an ADS route after one-time enabling, or through the Beckhoff Device Manager, with type, revision and, where present, firmware. The IPC itself needs a software inventory, because all 17 advisories via CERT@VDE (as of 7 Oct 2026) concern TwinCAT, TwinCAT/BSD and Device Manager, not the terminals. Beckhoff does not hand out an SBOM per product; for the plant you do not need one.
What hangs on a Beckhoff IPC and what of it is visible on the network
The controller is an industrial or embedded PC (CX, C6) with TwinCAT as EtherCAT master. Attached are EK couplers, EL/ELX terminals, EP box modules, AX drives and drive terminals (EL7xxx), sometimes with gateways into other networks (EL6631 PROFINET, EL6652 EtherNet/IP). Not all of it carries firmware: simple digital and analog terminals have none, complex terminals (communication, drive, safety) and couplers do.
- Visible via IP from the maintenance PC: the IPC (Windows or BSD inventory, Device Manager, OPC UA), gateways with their own I&M0 or CIP identity (EL6631, EL6652, EK9300, EK9000), switches and panels.
- Only via the master: all EtherCAT terminals, couplers and drives. Their identity (Vendor ID, Product Code, Revision, serial number) is stored in the SII EEPROM and in CoE object 0x1018, the firmware of complex terminals in object 0x100A. There is no way to reach them from outside, not even passively.
- Only from the engineering: terminals without firmware and without a digital interface. They do not belong in the plant SBOM, but they do belong in the bill of materials.
How the terminals get into the list: TwinCAT project, ADS route, Device Manager
There are three routes to the terminal list, with different reliability. The project shows what was planned; the ADS route and the Device Manager show what is running:
- TwinCAT project (
.sln+.tsproj): the configured I/O chain with type and revision per terminal. During "Scan Boxes" TwinCAT reads the identity from the EEPROM – that is the reference for "what is running". - ADS route to the IPC: once enabled, the terminal list, terminal firmware (object 0x100A, where available) and the TwinCAT version can be read without opening the project. This is how the network scan in mixed plants proceeds.
- Beckhoff Device Manager (MDP, web/REST/OPC UA) for the IPC itself: device type, operating system, TwinCAT version.
- Serial numbers on many terminals are only a date code (year/week), not an identifier of the individual device. For evidence purposes the type plate counts.
How Beckhoff publishes advisories and what matching runs on
Beckhoff has run a PSIRT for more than ten years and publishes advisories "as part of CERT@VDE together with other manufacturers" (Infosys page "Security Advisories"). The CSAF trusted provider is therefore not under beckhoff.com but at CERT@VDE: provider-metadata.json with ROLIE feed, index.txt and changes.csv. Beckhoff is not listed in the BSI's CSAF aggregator.
| Measurement (7 Oct 2026) | Result |
|---|---|
| Advisories in the CSAF feed in total | 17 (2019–2026) |
| of which published in 2026 | 2 (VDE-2025-092 Device Manager, VDE-2025-106 TwinCAT 3 HMI Server) |
| First publications 2024 / 2025 | 6 / 1 |
| Documents with CPE or PURL | 2 – both from 2026 |
| Documents with hardware order numbers as helpers | 0 |
The 15 older documents list only product name and version range ("TwinCAT/BSD <14.1.2.0_153968"). The two documents from 2026 go further than any other manufacturer in this series: PURL types for TwinCAT packages, BSD and Debian packages (pkg:tcpkg, pkg:bsd, pkg:deb), CPE for the diagnostics package, plus SHA-256 hashes of affected files. That is identification at package level – intended for a software inventory of the IPC, not for a device list.
All 17 advisories concern software: TwinCAT components, TwinCAT/BSD, Device Manager, HMI Server. The terminal list is therefore secondary for matching – what counts is the software inventory of the IPC: TwinCAT version, installed packages (TwinCAT Package Manager), operating system and patch level. Exactly the things a network scan does not deliver and a Windows or BSD inventory via a read-only account does.
Anyone working with a CPE-based tool at least finds the two newest Beckhoff advisories; the 15 older ones stay invisible. For a tool that compares name and version range, all 17 are usable.
Beckhoff does not hand out an SBOM per product; the two advisories from 2026 identify at package level anyway, which is enough for the software inventory of the IPC.
What this means for installations with Beckhoff components
- Carry the IPC as a product of its own with a software inventory: TwinCAT version, packages, operating system. That is the surface the advisories hit.
- Take the terminal list from the TwinCAT project or via ADS and add it to the device list with type and revision – do not search for it by port scan.
- PROFINET or EtherNet/IP gateways (EL6631, EL6652) additionally appear on the network with I&M0 or CIP identity and are recorded there.
Without an ADS route the terminal list stays in the project, and the project shows what was planned, not what is running. In Werkspilot Scan, Beckhoff is therefore stage 3: the run from the maintenance PC covers IPC, gateways and switches via IP and, after one-time enabling, the terminal list with firmware via ADS. We are currently trialling this stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.