Vulnerability · Published Jan 20, 2026 · Assigned by CERTVDE
CVE-2025-41768Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
Medium 5.5
In plain English
A medium-severity cross-site scripting in TF2000-HMI-Server from Beckhoff Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 84.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Beckhoff Automation | TwinCAT.HMI.Server | 0.0.0 – before 14.4.267 |
| Beckhoff Automation | TF2000-HMI-Server | 0.0.0 – before 14.4.267 |
| Beckhoff Automation | tf2000-hmi-server | 0.0.0 – before 14.4.267 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N