CVE-2025-41768 — Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

CVE-2025-41768

Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server PUBLISHED

Description (CNA)

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').

Affected (CNA)

Vendor / product	Versions
Beckhoff Automation / TwinCAT.HMI.Server	affected 0.0.0 before 14.4.267
Beckhoff Automation / TF2000-HMI-Server	affected 0.0.0 before 14.4.267
Beckhoff Automation / tf2000-hmi-server	affected 0.0.0 before 14.4.267

CWE

CWE-79

References

https://certvde.com/de/advisories/VDE-2025-106

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.