CVE-2025-41768: Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-20 · updated 2026-06-17
Weakness: CWE-79

Description

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').

Affected products

Beckhoff Automation TF2000-HMI-Server: before 14.4.267 — fixed in 14.4.267
Beckhoff Automation TwinCAT.HMI.Server: before 14.4.267 — fixed in 14.4.267

How to fix

Upgrade to a fixed version: Beckhoff Automation TF2000-HMI-Server 14.4.267; Beckhoff Automation TwinCAT.HMI.Server 14.4.267. Check the vendor advisory for mitigations.

References

https://certvde.com/de/advisories/VDE-2025-106

Get alerted when CVE-2025-41768 or the next vulnerability affects your stack