Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
An optional package of the TwinCAT 3 XAR installs the TwinCAT 3 HMI Server on a device. It provides a server configuration page which can be accessed by administrative users only. When such an administrator accesses the server configuration page it is possible to upload arbitrary content into the CUSTOM_CSS field which is then persisted on the device and later returned and rendered with each login and error page. Please note that administrators have the access rights to modify any content on the HMI server, for example, via the server configuration page. Therefore, administrators would have to act maliciously to exploit this vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41768US | — | — | ||
An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2025-106: Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server - CSAFself
- VDE-2025-106: Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server - HTMLself
- CERT@VDE Security Advisories for Beckhoff Automation GmbH & Co. KGexternal
- Beckhoff Security Advisory 2025-002: XSS Vulnerability in TwinCAT 3 HMI Server - PDF versionself
- Additional information about the latest security advisories is provided here:external
Behebungen (1)
- Behoben
Please update to a recent version of the affected components.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan