Description
An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Beckhoff Automation | TwinCAT.HMI.Server | 0.0.0 – < 14.4.267 | 14.4.267 |
| Beckhoff Automation | TF2000-HMI-Server | 0.0.0 – < 14.4.267 | 14.4.267 |
Advisories 1
- VDE-2025-106 Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server CERT@VDE · Feb 12, 2026