CVE-2025-41768

MEDIUM

Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-41768 has a selected CVSS score of 5.5 (medium).

Description

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 20, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

TF2000-HMI-Server

Browse Beckhoff Automation / TF2000-HMI-Server

Default status: unaffected

CVE List0.0.0 to < 14.4.267affected

TwinCAT.HMI.Server

Browse Beckhoff Automation / TwinCAT.HMI.Server

Default status: unaffected

CVE List0.0.0 to < 14.4.267affected

References

2