Skip to content
OpenAdvisories
Medium VDE-2025-106 1 CVE

Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

Published Jan 26, 2026 · Updated Feb 12, 2026 · Revision 2

Vendor: Beckhoff Product: tf2000-hmi-server Product: TwinCAT.HMI.Server

Summary

An optional package of the TwinCAT 3 XAR installs the TwinCAT 3 HMI Server on a device. It provides a server configuration page which can be accessed by administrative users only. When such an administrator accesses the server configuration page it is possible to upload arbitrary content into the CUSTOM_CSS field which is then persisted on the device and later returned and rendered with each login and error page.
Please note that administrators have the access rights to modify any content on the HMI server, for example, via the server configuration page. Therefore, administrators would have to act maliciously to exploit this vulnerability.

Details

Impact
On an instance of TwinCAT 3 HMI Server running on a device an authenticated administrator can inject arbitrary content into the custom CSS field which is persisted on the device and later returned via the login page and error page.

General Recommendation
Administrators must exercise due diligence when configuring the TwinCAT 3 HMI server via the server configuration page. Administrators must be selected from trustworthy personnel.

Remediation
Please update to a recent version of the affected components.

Vulnerabilities 1

  • Medium 5.5
    CVE-2025-41768

    Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

    An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').

    Beckhoff TwinCAT.HMI.Server tf2000-hmi-server ICS / OT

Revision history

  1. #1.0.1

    A typo was corrected in the CVE description.

  2. #1.0.0

    Initial revision

References