CVE-2025-41768
Persistent CSS Injection in TwinCAT 3 HMI Server by Admin
Publication date: 2026-01-20
Last updated on: 2026-02-12
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| beckhoff | twincat_3_hmi_server | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an authenticated administrator on a TwinCAT 3 HMI Server instance to inject arbitrary content into the custom CSS field. This injected content is stored on the device and later displayed on the login page and error page.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an authenticated administrator to inject malicious content into the device's custom CSS field, which is then rendered on the login and error pages. This could lead to information disclosure or manipulation of the user interface, potentially misleading users or exposing sensitive information.